Btrfs: fix array bound checking
PATCH 1/1 Btrfs: fix array bound checking
Otherwise we can execced the array bound of path->slots[].
Signed-off-by Li Zefan <[email protected]>
--- fs/btrfs/ctree.c | 10 ++++++---- 1 files changed, 6 insertions(+), 4 deletions(-)
fs/btrfs/ctree.c +6 -4
@@ -902,9 +902,10 @@ static noinline int balance_level(struct btrfs_trans_handle *trans, orig_ptr =btrfs_node_blockptr (mid, orig_slot); -if (level <BTRFS_MAX_LEVEL -1 ) +if (level <BTRFS_MAX_LEVEL -1 ) { parent = path->nodes[level +1 ]; - pslot = path->slots[level +1 ]; + pslot = path->slots[level +1 ]; + }/* * deal with the case where there is only one pointer in the root
@@ -1107,9 +1108,10 @@ static noinline int push_nodes_for_insert(struct btrfs_trans_handle *trans, mid = path->nodes[level];WARN_ON (btrfs_header_generation (mid) != trans->transid); -if (level <BTRFS_MAX_LEVEL -1 ) +if (level <BTRFS_MAX_LEVEL -1 ) { parent = path->nodes[level +1 ]; - pslot = path->slots[level +1 ]; + pslot = path->slots[level +1 ]; + }if (!parent)return 1 ;
Signature · 1 line
1.7.3.1
Quoted 3 lines · Li Zefan
Otherwise we can execced the array bound of path->slots[].
Signed-off-by Li Zefan <[email protected]>
Reviewed-by David Sterba <[email protected]>
Quoted 40 lines
--- fs/btrfs/ctree.c | 10 ++++++---- 1 files changed, 6 insertions(+), 4 deletions(-)fs/btrfs/ctree.c +6
-4@@ -902,9 +902,10 @@ static noinline int balance_level(struct btrfs_trans_handle *trans, orig_ptr =btrfs_node_blockptr (mid, orig_slot); -if (level <BTRFS_MAX_LEVEL -1 ) +if (level <BTRFS_MAX_LEVEL -1 ) { parent = path->nodes[level +1 ]; - pslot = path->slots[level +1 ]; + pslot = path->slots[level +1 ]; + }/* * deal with the case where there is only one pointer in the root @@ -1107,9 +1108,10 @@ static noinline int push_nodes_for_insert(struct btrfs_trans_handle *trans, mid = path->nodes[level];WARN_ON (btrfs_header_generation (mid) != trans->transid); -if (level <BTRFS_MAX_LEVEL -1 ) +if (level <BTRFS_MAX_LEVEL -1 ) { parent = path->nodes[level +1 ]; - pslot = path->slots[level +1 ]; + pslot = path->slots[level +1 ]; + }if (!parent)return 1 ;Signature · 5 lines
1.7.3.1 -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html