iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Btrfs: fix array bound checking

Browse Source 
Otherwise we can execced the array bound of path->slots[].

Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
This commit is contained in:
Li Zefan 2011-09-06 16:55:34 +08:00 committed by David Sterba
parent f4c697e640
commit a05a9bb18a
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/btrfs/ctree.c
View File

@ -902,9 +902,10 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
orig_ptr = btrfs_node_blockptr(mid, orig_slot); orig_ptr = btrfs_node_blockptr(mid, orig_slot);
if (level < BTRFS_MAX_LEVEL - 1) if (level < BTRFS_MAX_LEVEL - 1) {
parent = path->nodes[level + 1]; parent = path->nodes[level + 1];
pslot = path->slots[level + 1]; pslot = path->slots[level + 1];
}
/* /*
* deal with the case where there is only one pointer in the root * deal with the case where there is only one pointer in the root
@ -1107,9 +1108,10 @@ static noinline int push_nodes_for_insert(struct btrfs_trans_handle *trans,
mid = path->nodes[level]; mid = path->nodes[level];
WARN_ON(btrfs_header_generation(mid) != trans->transid); WARN_ON(btrfs_header_generation(mid) != trans->transid);
if (level < BTRFS_MAX_LEVEL - 1) if (level < BTRFS_MAX_LEVEL - 1) {
parent = path->nodes[level + 1]; parent = path->nodes[level + 1];
pslot = path->slots[level + 1]; pslot = path->slots[level + 1];
}
if (!parent) if (!parent)
return 1; return 1;