Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84850e8d authored by Yan, Zheng's avatar Yan, Zheng Committed by David Sterba
Browse files

btrfs: check file extent backref offset underflow 



Offset field in data extent backref can underflow if clone range ioctl
is used. We can reliably detect the underflow because max file size is
limited to 2^63 and max data extent size is limited by block group size.

Signed-off-by: default avatarZheng Yan <zheng.z.yan@intel.com>
parent 016fc6a6

fs/btrfs/relocation.c

+4 −1
Original line number Original line Diff line number Diff line
@@ -3322,8 +3322,11 @@ static int find_data_references(struct reloc_control *rc, 
	}

	}





	key.objectid = ref_objectid;

	key.objectid = ref_objectid;

	key.offset = ref_offset;

	key.type = BTRFS_EXTENT_DATA_KEY;

	key.type = BTRFS_EXTENT_DATA_KEY;

	if (ref_offset > ((u64)-1 << 32))

		key.offset = 0;

	else

		key.offset = ref_offset;





	path->search_commit_root = 1;

	path->search_commit_root = 1;

	path->skip_locking = 1;

	path->skip_locking = 1;