btrfs: fix iteration of extrefs during log replay

[ Upstream commit 54a7081ed168b72a8a2d6ef4ba3a1259705a2926 ]

At __inode_add_ref() when processing extrefs, if we jump into the next
label we have an undefined value of victim_name.len, since we haven't
initialized it before we did the goto. This results in an invalid memory
access in the next iteration of the loop since victim_name.len was not
initialized to the length of the name of the current extref.

Fix this by initializing victim_name.len with the current extref's name
length.

Fixes: e43eec81c516 ("btrfs: use struct qstr instead of name and namelen pairs")
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 6dbb62f83f8c8911f8d529a0fba7a55f12928b21..13377c3b22897d885383e6996897c46ca7a13d2c 100644 (file)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1162,13 +1162,13 @@ again:
                        struct fscrypt_str victim_name;
 
                        extref = (struct btrfs_inode_extref *)(base + cur_offset);
+                       victim_name.len = btrfs_inode_extref_name_len(leaf, extref);
 
                        if (btrfs_inode_extref_parent(leaf, extref) != parent_objectid)
                                goto next;
 
                        ret = read_alloc_one_name(leaf, &extref->name,
-                                btrfs_inode_extref_name_len(leaf, extref),
-                                &victim_name);
+                                                 victim_name.len, &victim_name);
                        if (ret)
                                return ret;