Commit 7ff2c2a1 authored Mar 18, 2019 by Nikolay Borisov Committed by David Sterba Mar 19, 2019

btrfs: Fix bound checking in qgroup_trace_new_subtree_blocks



If 'cur_level' is 7  then the bound checking at the top of the function
will actually pass. Later on, it's possible to dereference
ds_path->nodes[cur_level+1] which will be an out of bounds.

The correct check will be cur_level >= BTRFS_MAX_LEVEL - 1 .

Fixes-coverty-id: 1440918
Fixes-coverty-id: 1440911
Fixes: ea49f3e7 ("btrfs: qgroup: Introduce function to find all new tree blocks of reloc tree")
CC: stable@vger.kernel.org # 4.20+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

parent 3897b6f0

fs/btrfs/qgroup.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1922,8 +1922,8 @@ static int qgroup_trace_new_subtree_blocks(struct btrfs_trans_handle* trans,
		int i;

		/* Level sanity check */
		if (cur_level < 0 \|\| cur_level >= BTRFS_MAX_LEVEL \|\|
		root_level < 0 \|\| root_level >= BTRFS_MAX_LEVEL \|\|
		if (cur_level < 0 \|\| cur_level >= BTRFS_MAX_LEVEL - 1 \|\|
		root_level < 0 \|\| root_level >= BTRFS_MAX_LEVEL - 1 \|\|
		root_level < cur_level) {
		btrfs_err_rl(fs_info,
		"%s: bad levels, cur_level=%d root_level=%d",

Admin message