Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5dfe2be7 authored by Filipe Manana's avatar Filipe Manana Committed by Chris Mason
Browse files

Btrfs: fix off-by-one logic error in btrfs_realloc_node 



The end_slot variable actually matches the number of pointers in the
node and not the last slot (which is 'nritems - 1'). Therefore in order
to check that the current slot in the for loop doesn't match the last
one, the correct logic is to check if 'i' is less than 'end_slot - 1'
and not 'end_slot - 2'.

Fix this and set end_slot to be 'nritems - 1', as it's less confusing
since the variable name implies it's inclusive rather then exclusive.

Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
Signed-off-by: default avatarChris Mason <clm@fb.com>
parent e8c1c76e

fs/btrfs/ctree.c

+4 −4
Original line number Diff line number Diff line
@@ -1645,14 +1645,14 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans, 


	parent_nritems = btrfs_header_nritems(parent);

	blocksize = root->nodesize;

	end_slot = parent_nritems;

	end_slot = parent_nritems - 1;



	if (parent_nritems == 1)

	if (parent_nritems <= 1)

		return 0;



	btrfs_set_lock_blocking(parent);



	for (i = start_slot; i < end_slot; i++) {

	for (i = start_slot; i <= end_slot; i++) {

		int close = 1;



		btrfs_node_key(parent, &disk_key, i);
@@ -1669,7 +1669,7 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans, 
			other = btrfs_node_blockptr(parent, i - 1);

			close = close_blocks(blocknr, other, blocksize);

		}

		if (!close && i < end_slot - 2) {

		if (!close && i < end_slot) {

			other = btrfs_node_blockptr(parent, i + 1);

			close = close_blocks(blocknr, other, blocksize);

		}