From: Su Yue <suy.fnst@cn.fujitsu.com>
Date: Tue, 6 Jun 2017 09:57:06 +0000 (+0800)
Subject: btrfs: Check name_len before reading btrfs_get_name
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=488d7c4566536b8807381bc54e559fd43decd26a;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

btrfs: Check name_len before reading btrfs_get_name

In btrfs_get_name, there's btrfs_search_slot and reads name from
inode_ref/root_ref.

Call btrfs_is_name_len_valid in btrfs_get_name.

Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
---

diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 87144c9f9593..fa66980726c9 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -282,6 +282,11 @@ static int btrfs_get_name(struct dentry *parent, char *name,
 		name_len = btrfs_inode_ref_name_len(leaf, iref);
 	}
 
+	ret = btrfs_is_name_len_valid(leaf, path->slots[0], name_ptr, name_len);
+	if (!ret) {
+		btrfs_free_path(path);
+		return -EIO;
+	}
 	read_extent_buffer(leaf, name, name_ptr, name_len);
 	btrfs_free_path(path);