mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 03:27:30 -04:00
Code Issues Packages Projects Releases Wiki Activity

btrfs: reject inline file extents item in get_new_location()

Browse Source 
Commit a6908f88c9 ("btrfs: validate data reloc tree file extent item
members") introduced extra checks on file extent items for data reloc
inodes, but it checked the file extent offset without checking if the file
extent is inlined.

This can lead to either false alerts (as the offset member is inside the
inlined data) or even reading beyond the item range.

This has already triggered a warning in a syzbot report.
Although the root fix is to avoid compression for data reloc inodes, for
the sake of consistency, reject inlined file extents first.

Fixes: a6908f88c9 ("btrfs: validate data reloc tree file extent item members")
CC: stable@vger.kernel.org
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
Qu Wenruo
2026-06-23 21:07:15 +09:30
committed by David Sterba
parent ae4316f332
commit 800b519602
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
fs/btrfs/relocation.c
View File

@@ -890,6 +890,13 @@ static int get_new_location(struct inode *reloc_inode, u64 *new_bytenr,
leaf = path->nodes[0];
fi = btrfs_item_ptr(leaf, path->slots[0],
struct btrfs_file_extent_item);
if (unlikely(btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE)) {
btrfs_print_leaf(leaf);
btrfs_err(fs_info,
"unexpected inline file extent item for data reloc inode %llu key offset %llu",
btrfs_ino(BTRFS_I(reloc_inode)), bytenr);
return -EUCLEAN;
}
/*
* The cluster-boundary key searched above is always written by