RepoMirrors
/
btrfs-progs
mirror of https://github.com/kdave/btrfs-progs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

btrfs-progs: dir-item: Make btrfs_delete_one_dir_name more robust to handle corrupted name len 

Function btrfs_delete_one_dir_name() will check if the dir_item is the
last content of the item, and delete the whole item if needed.

However if @name_len of one dir_item/dir_index is corrupted and larger
than the item size, the function will still try to treat it as partly
remove, which will screw up the whole leaf.

This patch will enhance the item deletion check, to cover corrupted name
len, so in that case we just delete the whole item.

Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Su Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
Qu Wenruo 2018-01-19 15:25:36 +08:00 committed by David Sterba
parent 87103ff341
commit a8070228ab
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
dir-item.c
View File

@ -263,7 +263,6 @@ int btrfs_delete_one_dir_name(struct btrfs_trans_handle *trans,
struct btrfs_path *path, struct btrfs_path *path,
struct btrfs_dir_item *di) struct btrfs_dir_item *di)
{ {
struct extent_buffer *leaf; struct extent_buffer *leaf;
u32 sub_item_len; u32 sub_item_len;
u32 item_len; u32 item_len;
@ -273,7 +272,15 @@ int btrfs_delete_one_dir_name(struct btrfs_trans_handle *trans,
sub_item_len = sizeof(*di) + btrfs_dir_name_len(leaf, di) + sub_item_len = sizeof(*di) + btrfs_dir_name_len(leaf, di) +
btrfs_dir_data_len(leaf, di); btrfs_dir_data_len(leaf, di);
item_len = btrfs_item_size_nr(leaf, path->slots[0]); item_len = btrfs_item_size_nr(leaf, path->slots[0]);
if (sub_item_len == item_len) {
/*
* If @sub_item_len is longer than @item_len, then it means the
* name_len is just corrupted.
* No good idea to know if there is anything we can recover from
* the corrupted item.
* Just delete the item.
*/
if (sub_item_len >= item_len) {
ret = btrfs_del_item(trans, root, path); ret = btrfs_del_item(trans, root, path);
} else { } else {
unsigned long ptr = (unsigned long)di; unsigned long ptr = (unsigned long)di;