diff options
| author | Nikolay Borisov <nborisov@suse.com> | 2019-03-18 17:45:19 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-04-03 06:27:27 +0200 |
| commit | e3a605636a80164fa90f0a8b97a033ae790d9509 (patch) | |
| tree | 801f95ac4c5e5dd5f7511a08bd8ac624e8c4f260 /fs/btrfs | |
| parent | 4a0584a21542fe8000f72258a3884bfc65668a7e (diff) | |
| download | talos-obmc-linux-e3a605636a80164fa90f0a8b97a033ae790d9509.tar.gz talos-obmc-linux-e3a605636a80164fa90f0a8b97a033ae790d9509.zip | |
btrfs: Fix bound checking in qgroup_trace_new_subtree_blocks
commit 7ff2c2a1a71e83f74574b8001ea88deb3c166ad7 upstream.
If 'cur_level' is 7 then the bound checking at the top of the function
will actually pass. Later on, it's possible to dereference
ds_path->nodes[cur_level+1] which will be an out of bounds.
The correct check will be cur_level >= BTRFS_MAX_LEVEL - 1 .
Fixes-coverty-id: 1440918
Fixes-coverty-id: 1440911
Fixes: ea49f3e73c4b ("btrfs: qgroup: Introduce function to find all new tree blocks of reloc tree")
CC: stable@vger.kernel.org # 4.20+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/btrfs')
| -rw-r--r-- | fs/btrfs/qgroup.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c index 4e473a998219..543dd5e66f31 100644 --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -1917,8 +1917,8 @@ static int qgroup_trace_new_subtree_blocks(struct btrfs_trans_handle* trans, int i; /* Level sanity check */ - if (cur_level < 0 || cur_level >= BTRFS_MAX_LEVEL || - root_level < 0 || root_level >= BTRFS_MAX_LEVEL || + if (cur_level < 0 || cur_level >= BTRFS_MAX_LEVEL - 1 || + root_level < 0 || root_level >= BTRFS_MAX_LEVEL - 1 || root_level < cur_level) { btrfs_err_rl(fs_info, "%s: bad levels, cur_level=%d root_level=%d", |
