Filipe Manana
2014-Nov-07 12:15 UTC
[PATCH] Btrfs: avoid crash when overflowing a dir_item
When attempting to insert a new dir_item, we were calling btrfs_extent_item() without checking if the leaf has enough space to extend the item. This made btrfs_extent_item() crash through a BUG() call. Therefore do the check and return ENOSPC if the leaf doesn't have enough space. Signed-off-by: Filipe Manana <fdmanana@suse.com> --- fs/btrfs/dir-item.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c index fc8df86..65bf60e 100644 --- a/fs/btrfs/dir-item.c +++ b/fs/btrfs/dir-item.c @@ -53,6 +53,8 @@ static struct btrfs_dir_item *insert_with_overflow(struct btrfs_trans_handle di = btrfs_match_dir_item_name(root, path, name, name_len); if (di) return ERR_PTR(-EEXIST); + if (btrfs_leaf_free_space(root, path->nodes[0]) < data_size) + return ERR_PTR(-ENOSPC); btrfs_extend_item(root, path, data_size); } else if (ret < 0) return ERR_PTR(ret); -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html