Call 'btrfs_is_namelen_valid' before reading name. Signed-off-by: Su Yue <suy.f...@cn.fujitsu.com> --- fs/btrfs/tree-log.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c index ae51144571e2..fdab0f021197 100644 --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -4562,6 +4562,11 @@ static int btrfs_check_ref_name_override(struct extent_buffer *eb, this_len = sizeof(*extref) + this_name_len; } + ret = btrfs_is_namelen_valid(eb, slot, name_ptr, this_name_len); + if (!ret) { + ret = -EIO; + goto out; + } if (this_name_len > name_len) { char *new_name; -- 2.13.0 -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html