diff options
| author | Filipe Manana <fdmanana@suse.com> | 2016-07-02 05:43:46 +0100 |
|---|---|---|
| committer | Filipe Manana <fdmanana@suse.com> | 2016-08-01 07:26:15 +0100 |
| commit | 15b253eace1f98dabbc6e03f6793fcf8603b1655 (patch) | |
| tree | 16ad0cc9e5aa90ee47e7200bfa0c1693b0268453 /fs | |
| parent | 764433a12e78e1a2161793c02eceafdfed2d652b (diff) | |
| download | linux-0-day-15b253eace1f98dabbc6e03f6793fcf8603b1655.tar.gz linux-0-day-15b253eace1f98dabbc6e03f6793fcf8603b1655.tar.xz | |
Btrfs: send, avoid incorrect leaf accesses when sending utimes operations
The caller of send_utimes() is supposed to be sure that the inode number
it passes to this function does actually exists in the send snapshot.
However due to logic/algorithm bugs (such as the one fixed by the patch
titled "Btrfs: send, fix invalid leaf accesses due to incorrect utimes
operations"), this might not be the case and when that happens it makes
send_utimes() access use an unrelated leaf item as the target inode item
or access beyond a leaf's boundaries (when the leaf is full and
path->slots[0] matches the number of items in the leaf).
So if the call to btrfs_search_slot() done by send_utimes() does not find
the inode item, just make sure send_utimes() returns -ENOENT and does not
silently accesses unrelated leaf items or does invalid leaf accesses, also
allowing us to easialy and deterministically catch such algorithmic/logic
bugs.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/btrfs/send.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index 8b653967b1638..2db8dc89ca418 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -2502,6 +2502,8 @@ verbose_printk("btrfs: send_utimes %llu\n", ino); key.type = BTRFS_INODE_ITEM_KEY; key.offset = 0; ret = btrfs_search_slot(NULL, sctx->send_root, &key, path, 0, 0); + if (ret > 0) + ret = -ENOENT; if (ret < 0) goto out; |