On 16.11.18 г. 9:54 ч., Qu Wenruo wrote:
> The only hit is the following code:
>
> tlv_len = le16_to_cpu(tlv_hdr->tlv_len);
>
> if (tlv_type == 0 || tlv_type > BTRFS_SEND_A_MAX
> || tlv_len > BTRFS_SEND_BUF_SIZE) {
> error("invalid tlv in cmd tlv_type = %hu, tlv_len = %hu",
> tlv_type, tlv_len);
>
> @tlv_len is u16, while BTRFS_SEND_BUF_SIZE is 64K.
> u16 MAX is 64K - 1, so the final check is always false.
>
> Just remove it.
>
> Signed-off-by: Qu Wenruo <wqu@xxxxxxxx>
I had an identical patch:
Reviewed-by: Nikolay Borisov <nborisov@xxxxxxxx>
> ---
> send-stream.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/send-stream.c b/send-stream.c
> index 3b8e39c9486a..25461e92c37b 100644
> --- a/send-stream.c
> +++ b/send-stream.c
> @@ -157,8 +157,7 @@ static int read_cmd(struct btrfs_send_stream *sctx)
> tlv_type = le16_to_cpu(tlv_hdr->tlv_type);
> tlv_len = le16_to_cpu(tlv_hdr->tlv_len);
>
> - if (tlv_type == 0 || tlv_type > BTRFS_SEND_A_MAX
> - || tlv_len > BTRFS_SEND_BUF_SIZE) {
> + if (tlv_type == 0 || tlv_type > BTRFS_SEND_A_MAX) {
> error("invalid tlv in cmd tlv_type = %hu, tlv_len = %hu",
> tlv_type, tlv_len);
> ret = -EINVAL;
>
