On 16.11.18 г. 9:54 ч., Qu Wenruo wrote:
> The only hit is the following code:
> 
>               tlv_len = le16_to_cpu(tlv_hdr->tlv_len);
> 
>               if (tlv_type == 0 || tlv_type > BTRFS_SEND_A_MAX
>                   || tlv_len > BTRFS_SEND_BUF_SIZE) {
>                       error("invalid tlv in cmd tlv_type = %hu, tlv_len = 
> %hu",
>                                       tlv_type, tlv_len);
> 
> @tlv_len is u16, while BTRFS_SEND_BUF_SIZE is 64K.
> u16 MAX is 64K - 1, so the final check is always false.
> 
> Just remove it.
> 
> Signed-off-by: Qu Wenruo <w...@suse.com>

I had an identical patch:

Reviewed-by: Nikolay Borisov <nbori...@suse.com>

> ---
>  send-stream.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/send-stream.c b/send-stream.c
> index 3b8e39c9486a..25461e92c37b 100644
> --- a/send-stream.c
> +++ b/send-stream.c
> @@ -157,8 +157,7 @@ static int read_cmd(struct btrfs_send_stream *sctx)
>               tlv_type = le16_to_cpu(tlv_hdr->tlv_type);
>               tlv_len = le16_to_cpu(tlv_hdr->tlv_len);
>  
> -             if (tlv_type == 0 || tlv_type > BTRFS_SEND_A_MAX
> -                 || tlv_len > BTRFS_SEND_BUF_SIZE) {
> +             if (tlv_type == 0 || tlv_type > BTRFS_SEND_A_MAX) {
>                       error("invalid tlv in cmd tlv_type = %hu, tlv_len = 
> %hu",
>                                       tlv_type, tlv_len);
>                       ret = -EINVAL;
> 

Reply via email to