| To: | david@xxxxxxxxxxxxx, darrick.wong@xxxxxxxxxx |
|---|---|
| Subject: | [PATCH 2/5] xfs: don't perform lookups on zero-height btrees |
| From: | "Darrick J. Wong" <darrick.wong@xxxxxxxxxx> |
| Date: | Tue, 23 Aug 2016 19:20:41 -0700 |
| Cc: | linux-xfs@xxxxxxxxxxxxxxx, xfs@xxxxxxxxxxx |
| Delivered-to: | xfs@xxxxxxxxxxx |
| In-reply-to: | <147200522764.14738.15186015137934319456.stgit@xxxxxxxxxxxxxxxx> |
| References: | <147200522764.14738.15186015137934319456.stgit@xxxxxxxxxxxxxxxx> |
| User-agent: | StGit/0.17.1-dirty |
If the caller passes in a cursor to a zero-height btree (which is
impossible), we never set block to anything but NULL, which causes the
later dereference of it to crash. Instead, just return -EFSCORRUPTED.
Signed-off-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx>
---
fs/xfs/libxfs/xfs_btree.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index b5c213a..33f1406 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -1814,6 +1814,10 @@ xfs_btree_lookup(
XFS_BTREE_STATS_INC(cur, lookup);
+ /* No such thing as a zero-level tree. */
+ if (cur->bc_nlevels == 0)
+ return -EFSCORRUPTED;
+
block = NULL;
keyno = 0;
|
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | [PATCH 1/5] xfs: don't log the entire end of the AGF, Darrick J. Wong |
|---|---|
| Next by Date: | [PATCH 3/5] xfs: fix some key handling problems in _btree_simple_query_range, Darrick J. Wong |
| Previous by Thread: | Re: [PATCH 1/5] xfs: don't log the entire end of the AGF, Christoph Hellwig |
| Next by Thread: | Re: [PATCH 2/5] xfs: don't perform lookups on zero-height btrees, Christoph Hellwig |
| Indexes: | [Date] [Thread] [Top] [All Lists] |