The only hit is the following code:

                tlv_len = le16_to_cpu(tlv_hdr->tlv_len);

                if (tlv_type == 0 || tlv_type > BTRFS_SEND_A_MAX
                    || tlv_len > BTRFS_SEND_BUF_SIZE) {
                        error("invalid tlv in cmd tlv_type = %hu, tlv_len = 
%hu",
                                        tlv_type, tlv_len);

@tlv_len is u16, while BTRFS_SEND_BUF_SIZE is 64K.
u16 MAX is 64K - 1, so the final check is always false.

Just remove it.

Signed-off-by: Qu Wenruo <w...@suse.com>
Reviewed-by: Nikolay Borisov <nbori...@suse.com>
---
 send-stream.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/send-stream.c b/send-stream.c
index 3b8e39c9486a..25461e92c37b 100644
--- a/send-stream.c
+++ b/send-stream.c
@@ -157,8 +157,7 @@ static int read_cmd(struct btrfs_send_stream *sctx)
                tlv_type = le16_to_cpu(tlv_hdr->tlv_type);
                tlv_len = le16_to_cpu(tlv_hdr->tlv_len);
 
-               if (tlv_type == 0 || tlv_type > BTRFS_SEND_A_MAX
-                   || tlv_len > BTRFS_SEND_BUF_SIZE) {
+               if (tlv_type == 0 || tlv_type > BTRFS_SEND_A_MAX) {
                        error("invalid tlv in cmd tlv_type = %hu, tlv_len = 
%hu",
                                        tlv_type, tlv_len);
                        ret = -EINVAL;
-- 
2.19.2

Reply via email to