summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChris Mason <clm@fb.com>2014-04-26 05:02:03 -0700
committerChris Mason <clm@fb.com>2014-04-26 05:02:03 -0700
commitcfd4a535b68faf651b238586011f5bae128391c4 (patch)
tree03380f86411c67a7ba84d3af697dcdfd01b9f66f
parentf8213bdc89719bad895a02c62c4a85066ff76720 (diff)
downloadlinux-cfd4a535b68faf651b238586011f5bae128391c4.tar.bz2
Btrfs: limit the path size in send to PATH_MAX
fs_path_ensure_buf is used to make sure our path buffers for send are big enough for the path names as we construct them. The buffer size is limited to 32K by the length field in the struct. But bugs in the path construction can end up trying to build a huge buffer, and we'll do invalid memmmoves when the buffer length field wraps. This patch is step one, preventing the overflows. Signed-off-by: Chris Mason <clm@fb.com>
-rw-r--r--fs/btrfs/send.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 1ac3ca98c429..eb6537a08c1b 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -349,6 +349,11 @@ static int fs_path_ensure_buf(struct fs_path *p, int len)
if (p->buf_len >= len)
return 0;
+ if (len > PATH_MAX) {
+ WARN_ON(1);
+ return -ENOMEM;
+ }
+
path_len = p->end - p->start;
old_buf_len = p->buf_len;