Re: [PATCH] Btrfs: fix array bound checking

[David Sterba <dave@jikos.cz>]

On Tue, Sep 06, 2011 at 04:55:34PM +0800, Li Zefan wrote:
> Otherwise we can execced the array bound of path->slots[].
> 
> Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Reviewed-by: David Sterba <dsterba@suse.cz>

> ---
>  fs/btrfs/ctree.c |   10 ++++++----
>  1 files changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
> index 011cab3..0fe615e 100644
> --- a/fs/btrfs/ctree.c
> +++ b/fs/btrfs/ctree.c
> @@ -902,9 +902,10 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
>  
>  	orig_ptr = btrfs_node_blockptr(mid, orig_slot);
>  
> -	if (level < BTRFS_MAX_LEVEL - 1)
> +	if (level < BTRFS_MAX_LEVEL - 1) {
>  		parent = path->nodes[level + 1];
> -	pslot = path->slots[level + 1];
> +		pslot = path->slots[level + 1];
> +	}
>  
>  	/*
>  	 * deal with the case where there is only one pointer in the root
> @@ -1107,9 +1108,10 @@ static noinline int push_nodes_for_insert(struct btrfs_trans_handle *trans,
>  	mid = path->nodes[level];
>  	WARN_ON(btrfs_header_generation(mid) != trans->transid);
>  
> -	if (level < BTRFS_MAX_LEVEL - 1)
> +	if (level < BTRFS_MAX_LEVEL - 1) {
>  		parent = path->nodes[level + 1];
> -	pslot = path->slots[level + 1];
> +		pslot = path->slots[level + 1];
> +	}
>  
>  	if (!parent)
>  		return 1;
> -- 
> 1.7.3.1
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html