btrfs: Cleanup existing name_len checks (bae15d95) · Commits · 戴 / test

fs/btrfs/ctree.h

+0 −5

Original line number	Diff line number	Diff line
		@@ -3060,15 +3060,10 @@ struct btrfs_dir_item btrfs_lookup_xattr(struct btrfs_trans_handle trans,
		struct btrfs_path *path, u64 dir,
		const char *name, u16 name_len,
		int mod);
		int verify_dir_item(struct btrfs_fs_info *fs_info,
		struct extent_buffer *leaf, int slot,
		struct btrfs_dir_item *dir_item);
		struct btrfs_dir_item btrfs_match_dir_item_name(struct btrfs_fs_info fs_info,
		struct btrfs_path *path,
		const char *name,
		int name_len);
		bool btrfs_is_name_len_valid(struct extent_buffer *leaf, int slot,
		unsigned long start, u16 name_len);

		/* orphan.c */
		int btrfs_insert_orphan_item(struct btrfs_trans_handle *trans,

fs/btrfs/dir-item.c

+0 −108

Original line number	Diff line number	Diff line
		@@ -403,8 +403,6 @@ struct btrfs_dir_item btrfs_match_dir_item_name(struct btrfs_fs_info fs_info,
		btrfs_dir_data_len(leaf, dir_item);
		name_ptr = (unsigned long)(dir_item + 1);

		if (verify_dir_item(fs_info, leaf, path->slots[0], dir_item))
		return NULL;
		if (btrfs_dir_name_len(leaf, dir_item) == name_len &&
		memcmp_extent_buffer(leaf, name, name_ptr, name_len) == 0)
		return dir_item;
		@@ -450,109 +448,3 @@ int btrfs_delete_one_dir_name(struct btrfs_trans_handle *trans,
		}
		return ret;
		}

		int verify_dir_item(struct btrfs_fs_info *fs_info,
		struct extent_buffer *leaf,
		int slot,
		struct btrfs_dir_item *dir_item)
		{
		u16 namelen = BTRFS_NAME_LEN;
		int ret;
		u8 type = btrfs_dir_type(leaf, dir_item);

		if (type >= BTRFS_FT_MAX) {
		btrfs_crit(fs_info, "invalid dir item type: %d", (int)type);
		return 1;
		}

		if (type == BTRFS_FT_XATTR)
		namelen = XATTR_NAME_MAX;

		if (btrfs_dir_name_len(leaf, dir_item) > namelen) {
		btrfs_crit(fs_info, "invalid dir item name len: %u",
		(unsigned)btrfs_dir_name_len(leaf, dir_item));
		return 1;
		}

		namelen = btrfs_dir_name_len(leaf, dir_item);
		ret = btrfs_is_name_len_valid(leaf, slot,
		(unsigned long)(dir_item + 1), namelen);
		if (!ret)
		return 1;

		/* BTRFS_MAX_XATTR_SIZE is the same for all dir items */
		if ((btrfs_dir_data_len(leaf, dir_item) +
		btrfs_dir_name_len(leaf, dir_item)) >
		BTRFS_MAX_XATTR_SIZE(fs_info)) {
		btrfs_crit(fs_info, "invalid dir item name + data len: %u + %u",
		(unsigned)btrfs_dir_name_len(leaf, dir_item),
		(unsigned)btrfs_dir_data_len(leaf, dir_item));
		return 1;
		}

		return 0;
		}

		bool btrfs_is_name_len_valid(struct extent_buffer *leaf, int slot,
		unsigned long start, u16 name_len)
		{
		struct btrfs_fs_info *fs_info = leaf->fs_info;
		struct btrfs_key key;
		u32 read_start;
		u32 read_end;
		u32 item_start;
		u32 item_end;
		u32 size;
		bool ret = true;

		ASSERT(start > BTRFS_LEAF_DATA_OFFSET);

		read_start = start - BTRFS_LEAF_DATA_OFFSET;
		read_end = read_start + name_len;
		item_start = btrfs_item_offset_nr(leaf, slot);
		item_end = btrfs_item_end_nr(leaf, slot);

		btrfs_item_key_to_cpu(leaf, &key, slot);

		switch (key.type) {
		case BTRFS_DIR_ITEM_KEY:
		case BTRFS_XATTR_ITEM_KEY:
		case BTRFS_DIR_INDEX_KEY:
		size = sizeof(struct btrfs_dir_item);
		break;
		case BTRFS_INODE_REF_KEY:
		size = sizeof(struct btrfs_inode_ref);
		break;
		case BTRFS_INODE_EXTREF_KEY:
		size = sizeof(struct btrfs_inode_extref);
		break;
		case BTRFS_ROOT_REF_KEY:
		case BTRFS_ROOT_BACKREF_KEY:
		size = sizeof(struct btrfs_root_ref);
		break;
		default:
		ret = false;
		goto out;
		}

		if (read_start < item_start) {
		ret = false;
		goto out;
		}
		if (read_end > item_end) {
		ret = false;
		goto out;
		}

		/* there shall be item(s) before name */
		if (read_start - item_start < size) {
		ret = false;
		goto out;
		}

		out:
		if (!ret)
		btrfs_crit(fs_info, "invalid dir item name len: %u",
		(unsigned int)name_len);
		return ret;
		}

fs/btrfs/export.c

+0 −5

Original line number	Diff line number	Diff line
		@@ -283,11 +283,6 @@ static int btrfs_get_name(struct dentry parent, char name,
		name_len = btrfs_inode_ref_name_len(leaf, iref);
		}

		ret = btrfs_is_name_len_valid(leaf, path->slots[0], name_ptr, name_len);
		if (!ret) {
		btrfs_free_path(path);
		return -EIO;
		}
		read_extent_buffer(leaf, name, name_ptr, name_len);
		btrfs_free_path(path);

fs/btrfs/inode.c

+0 −4

Original line number	Diff line number	Diff line
		@@ -5907,7 +5907,6 @@ static int btrfs_filldir(void addr, int entries, struct dir_context ctx)
		static int btrfs_real_readdir(struct file file, struct dir_context ctx)
		{
		struct inode *inode = file_inode(file);
		struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
		struct btrfs_root *root = BTRFS_I(inode)->root;
		struct btrfs_file_private *private = file->private_data;
		struct btrfs_dir_item *di;
		@@ -5975,9 +5974,6 @@ again:
		if (btrfs_should_delete_dir_index(&del_list, found_key.offset))
		goto next;
		di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item);
		if (verify_dir_item(fs_info, leaf, slot, di))
		goto next;

		name_len = btrfs_dir_name_len(leaf, di);
		if ((total_len + sizeof(struct dir_entry) + name_len) >=
		PAGE_SIZE) {

fs/btrfs/props.c

+0 −7

Original line number	Diff line number	Diff line
		@@ -164,7 +164,6 @@ static int iterate_object_props(struct btrfs_root *root,
		size_t),
		void *ctx)
		{
		struct btrfs_fs_info *fs_info = root->fs_info;
		int ret;
		char *name_buf = NULL;
		char *value_buf = NULL;
		@@ -215,12 +214,6 @@ static int iterate_object_props(struct btrfs_root *root,
		name_ptr = (unsigned long)(di + 1);
		data_ptr = name_ptr + name_len;

		if (verify_dir_item(fs_info, leaf,
		path->slots[0], di)) {
		ret = -EIO;
		goto out;
		}

		if (name_len <= XATTR_BTRFS_PREFIX_LEN \|\|
		memcmp_extent_buffer(leaf, XATTR_BTRFS_PREFIX,
		name_ptr,

Admin message