diff options
| author |   Filipe David Borba Manana <fdmanana@gmail.com> | 2013-10-28 16:28:30 +0000 |
|---|---|---|
| committer |   Chris Mason <chris.mason@fusionio.com> | 2013-11-11 22:10:36 -0500 |
| commit | e46f5388cdde0f402f2dded6f1cad614536c6429 (patch) | |
| tree | 1a51753979036d5e9344dbd5cfac4075d20e20ea /fs/btrfs/dir-item.c | |
| parent | Btrfs: remove scrub_super_lock holding in btrfs_sync_log() (diff) | |
| download | linux-dev-e46f5388cdde0f402f2dded6f1cad614536c6429.tar.xz linux-dev-e46f5388cdde0f402f2dded6f1cad614536c6429.zip | |
Btrfs: fix verification of dir_item
We were ignoring the name component of the dir_item. Both the
name and data must fit within BTRFS_MAX_XATTR_SIZE(root).
Signed-off-by: Filipe David Borba Manana <fdmanana@gmail.com>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
Signed-off-by: Chris Mason <chris.mason@fusionio.com>
Diffstat (limited to 'fs/btrfs/dir-item.c')
| -rw-r--r-- | fs/btrfs/dir-item.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c index 1c529db1697f..c031ea3fd70f 100644 --- a/fs/btrfs/dir-item.c +++ b/fs/btrfs/dir-item.c @@ -474,8 +474,10 @@ int verify_dir_item(struct btrfs_root *root, } /* BTRFS_MAX_XATTR_SIZE is the same for all dir items */ - if (btrfs_dir_data_len(leaf, dir_item) > BTRFS_MAX_XATTR_SIZE(root)) { - printk(KERN_CRIT "btrfs: invalid dir item data len: %u\n", + if ((btrfs_dir_data_len(leaf, dir_item) + + btrfs_dir_name_len(leaf, dir_item)) > BTRFS_MAX_XATTR_SIZE(root)) { + printk(KERN_CRIT "btrfs: invalid dir item name + data len: %u + %u\n", + (unsigned)btrfs_dir_name_len(leaf, dir_item), (unsigned)btrfs_dir_data_len(leaf, dir_item)); return 1; } |