From: Filipe David Borba Manana Date: Mon, 28 Oct 2013 16:28:30 +0000 (+0000) Subject: Btrfs: fix verification of dir_item X-Git-Tag: upstream/snapshot3+hdmi~3791^2~50 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e46f5388cdde0f402f2dded6f1cad614536c6429;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git Btrfs: fix verification of dir_item We were ignoring the name component of the dir_item. Both the name and data must fit within BTRFS_MAX_XATTR_SIZE(root). Signed-off-by: Filipe David Borba Manana Signed-off-by: Josef Bacik Signed-off-by: Chris Mason --- diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c index 1c529db..c031ea3 100644 --- a/fs/btrfs/dir-item.c +++ b/fs/btrfs/dir-item.c @@ -474,8 +474,10 @@ int verify_dir_item(struct btrfs_root *root, } /* BTRFS_MAX_XATTR_SIZE is the same for all dir items */ - if (btrfs_dir_data_len(leaf, dir_item) > BTRFS_MAX_XATTR_SIZE(root)) { - printk(KERN_CRIT "btrfs: invalid dir item data len: %u\n", + if ((btrfs_dir_data_len(leaf, dir_item) + + btrfs_dir_name_len(leaf, dir_item)) > BTRFS_MAX_XATTR_SIZE(root)) { + printk(KERN_CRIT "btrfs: invalid dir item name + data len: %u + %u\n", + (unsigned)btrfs_dir_name_len(leaf, dir_item), (unsigned)btrfs_dir_data_len(leaf, dir_item)); return 1; }