forked from luck/tmp_suning_uos_patched
Btrfs: limit the path size in send to PATH_MAX
fs_path_ensure_buf is used to make sure our path buffers for send are big enough for the path names as we construct them. The buffer size is limited to 32K by the length field in the struct. But bugs in the path construction can end up trying to build a huge buffer, and we'll do invalid memmmoves when the buffer length field wraps. This patch is step one, preventing the overflows. Signed-off-by: Chris Mason <clm@fb.com>
This commit is contained in:
parent
f8213bdc89
commit
cfd4a535b6
|
@ -349,6 +349,11 @@ static int fs_path_ensure_buf(struct fs_path *p, int len)
|
||||||
if (p->buf_len >= len)
|
if (p->buf_len >= len)
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
if (len > PATH_MAX) {
|
||||||
|
WARN_ON(1);
|
||||||
|
return -ENOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
path_len = p->end - p->start;
|
path_len = p->end - p->start;
|
||||||
old_buf_len = p->buf_len;
|
old_buf_len = p->buf_len;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user