On Tue, Sep 25, 2012 at 04:04:46PM -0400, Chris Mason wrote:
> @@ -889,16 +899,23 @@ static inline int __add_inode_ref(struct 
> btrfs_trans_handle *trans,
>               while (cur_offset < item_size) {
>                       extref = (struct btrfs_inode_extref *)base + cur_offset;
>  
> -                     victim_name_len = btrfs_inode_extref_name_len(eb, 
> extref);
> -                     victim_name = kmalloc(namelen, GFP_NOFS);
> -                     leaf = path->nodes[0];
> -                     read_extent_buffer(eb, name, (unsigned 
> long)&extref->name, namelen);
> +                     victim_name_len = btrfs_inode_extref_name_len(leaf, 
> extref);
> +
> +                     if (btrfs_inode_extref_parent(leaf, extref) != 
> parent_objectid)
> +                             goto next;
> +
> +                     victim_name = kmalloc(victim_name_len, GFP_NOFS);

unchecked kmalloc

> +                     read_extent_buffer(leaf, victim_name, (unsigned 
> long)&extref->name,
> +                                        victim_name_len);
>  
>                       search_key.objectid = inode_objectid;
>                       search_key.type = BTRFS_INODE_EXTREF_KEY;
>                       search_key.offset = btrfs_extref_hash(parent_objectid,
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to