diff options
| author | Eric Sandeen <sandeen@redhat.com> | 2013-04-26 16:06:04 -0500 |
|---|---|---|
| committer | David Sterba <dsterba@suse.cz> | 2013-08-09 14:32:27 +0200 |
| commit | a3e5eeb94c5ae524ca5af9b39d63f21810a173f1 (patch) | |
| tree | 1e28e89dd6ca00340b84593210a7c1e7daf69cca /ctree.c | |
| parent | e54d41d7c675f3094f912dbc951aebdcdf82b4b3 (diff) | |
Btrfs-progs: fix array bound checking
Otherwise we can execced the array bound of path->slots[].
[Eric Sandeen: port kernel commit a05a9bb to userspace]
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <chris.mason@fusionio.com>
Diffstat (limited to 'ctree.c')
| -rw-r--r-- | ctree.c | 10 |
1 files changed, 6 insertions, 4 deletions
@@ -827,9 +827,10 @@ static int balance_level(struct btrfs_trans_handle *trans, orig_ptr = btrfs_node_blockptr(mid, orig_slot); - if (level < BTRFS_MAX_LEVEL - 1) + if (level < BTRFS_MAX_LEVEL - 1) { parent = path->nodes[level + 1]; - pslot = path->slots[level + 1]; + pslot = path->slots[level + 1]; + } /* * deal with the case where there is only one pointer in the root @@ -1019,9 +1020,10 @@ static int noinline push_nodes_for_insert(struct btrfs_trans_handle *trans, mid = path->nodes[level]; WARN_ON(btrfs_header_generation(mid) != trans->transid); - if (level < BTRFS_MAX_LEVEL - 1) + if (level < BTRFS_MAX_LEVEL - 1) { parent = path->nodes[level + 1]; - pslot = path->slots[level + 1]; + pslot = path->slots[level + 1]; + } if (!parent) return 1; |