Btrfs:__add_inode_ref: out of bounds memory read when looking for extended ref.
authorQuentin Casasnovas <quentin.casasnovas@oracle.com>
Tue, 3 Mar 2015 15:31:38 +0000 (16:31 +0100)
committerChris Mason <clm@fb.com>
Fri, 6 Mar 2015 01:28:33 +0000 (17:28 -0800)
Improper arithmetics when calculting the address of the extended ref could
lead to an out of bounds memory read and kernel panic.

Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.cz>
cc: stable@vger.kernel.org # v3.7+
Signed-off-by: Chris Mason <clm@fb.com>
fs/btrfs/tree-log.c

index f96996a1b70c92352491146ec8bba26f14cee13c..9a1c1711f3601a7b5f850b84dcbb3cce21d5d0a7 100644 (file)
@@ -1012,7 +1012,7 @@ again:
                base = btrfs_item_ptr_offset(leaf, path->slots[0]);
 
                while (cur_offset < item_size) {
-                       extref = (struct btrfs_inode_extref *)base + cur_offset;
+                       extref = (struct btrfs_inode_extref *)(base + cur_offset);
 
                        victim_name_len = btrfs_inode_extref_name_len(leaf, extref);