mirrors/scoutfs
1
0
Fork 0
mirror of https://github.com/versity/scoutfs.git synced 2026-01-10 05:37:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

scoutfs: check for bad radix merge count

Browse Source 
When we're merging bits that are set in a read-only input tree then we
can't try to merge more bits than exist in the input tree.  That'll
cause us to loop around and double-free bits.

Signed-off-by: Zach Brown <zab@versity.com>
This commit is contained in:
Zach Brown
2020-04-14 11:55:31 -07:00
committed by Zach Brown
parent 4c1f78afd4
commit 968e719a9a
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
kmod/src/radix.c
View File

@@ -1355,6 +1355,13 @@ int scoutfs_radix_merge(struct super_block *sb,
mutex_lock(&alloc->mutex);
/* can't try to free too much when inp is read-only */
if (inp != src &&
WARN_ON_ONCE(count > le64_to_cpu(inp->ref.sm_total))) {
ret = -EINVAL;
goto out;
}
while (count > 0) {
chg = alloc_change();