Unverified Commit 693eeef5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12445 nilfs2: fix potential oob read in nilfs_btree_check_delete() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Long Li <leo.lilong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/U3Z4DS7IO4GGMWWLXAUHZKAKMBOAHVWU/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYQRO 
 
Link:https://gitee.com/openeuler/kernel/pulls/12445

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 43f46df2 7341e9a5

fs/nilfs2/btree.c

+5 −2
Original line number Diff line number Diff line
@@ -1659,13 +1659,16 @@ static int nilfs_btree_check_delete(struct nilfs_bmap *btree, __u64 key) 
	int nchildren, ret;



	root = nilfs_btree_get_root(btree);

	nchildren = nilfs_btree_node_get_nchildren(root);

	if (unlikely(nchildren == 0))

		return 0;



	switch (nilfs_btree_height(btree)) {

	case 2:

		bh = NULL;

		node = root;

		break;

	case 3:

		nchildren = nilfs_btree_node_get_nchildren(root);

		if (nchildren > 1)

			return 0;

		ptr = nilfs_btree_node_get_ptr(root, nchildren - 1,
@@ -1674,12 +1677,12 @@ static int nilfs_btree_check_delete(struct nilfs_bmap *btree, __u64 key) 
		if (ret < 0)

			return ret;

		node = (struct nilfs_btree_node *)bh->b_data;

		nchildren = nilfs_btree_node_get_nchildren(node);

		break;

	default:

		return 0;

	}



	nchildren = nilfs_btree_node_get_nchildren(node);

	maxkey = nilfs_btree_node_get_key(node, nchildren - 1);

	nextmaxkey = (nchildren > 1) ?

		nilfs_btree_node_get_key(node, nchildren - 2) : 0;