btrfs-progs: handle invalid num_stripes in sys_array

We can handle the special case of num_stripes == 0 directly inside
btrfs_read_sys_array. The BUG_ON in btrfs_chunk_item_size is there to
catch other unhandled cases where we fail to validate external data,
like in btrfs-show-super.

Signed-off-by: David Sterba <dsterba@suse.com>
master
David Sterba 2015-11-30 16:44:29 +01:00
parent d9463cfeaa
commit 81e43dabc8
1 changed files with 8 additions and 0 deletions

View File

@ -1839,6 +1839,14 @@ int btrfs_read_sys_array(struct btrfs_root *root)
goto out_short_read;
num_stripes = btrfs_chunk_num_stripes(sb, chunk);
if (!num_stripes) {
printk(
"ERROR: invalid number of stripes %u in sys_array at offset %u\n",
num_stripes, cur_offset);
ret = -EIO;
break;
}
len = btrfs_chunk_item_size(num_stripes);
if (cur_offset + len > array_size)
goto out_short_read;