Skip to contentSkip to conversation

btrfs: check file extent backref offset underflow

PATCH In review Yan, Zheng 2 participants 2 messages Aug 29, 2011 Btrfs file system

lore
Share & tools
lore

Yan, Zheng

author
#0 lore raw

PATCH 1/1 btrfs: check file extent backref offset underflow

Offset field in data extent backref can underflow if clone range ioctl is used. We can reliably detect the underflow because max file size is limited to 2^63 and max data extent size is limited by block group size.

Signed-off-by Zheng Yan <[email protected]>

---

fs/btrfs/relocation.c +4 -1
index 59bb176..107c9cf 100644
@@ -3323,8 +3323,11 @@ static int find_data_references(struct reloc_control *rc,
 	}
 
 	key.objectid = ref_objectid;
-	key.offset = ref_offset;
 	key.type = BTRFS_EXTENT_DATA_KEY;
+	if (ref_offset > ((u64)-1 << 32))
+		key.offset = 0;
+	else
+		key.offset = ref_offset;
 
 	path->search_commit_root = 1;
 	path->skip_locking = 1;
Tested-by on v1 1/1
#1 lore raw
Quoted 5 lines · Zheng

Offset field in data extent backref can underflow if clone range ioctl is used. We can reliably detect the underflow because max file size is limited to 2^63 and max data extent size is limited by block group size.

Signed-off-by Zheng Yan <[email protected]>
Tested-by Li Zefan <[email protected]>

...

fs/btrfs/relocation.c static int find_data_references(struct reloc_control *rc, · line 3330

Quoted 10 lines
fs/btrfs/relocation.c +4 -1
@@ -3323,8 +3323,11 @@ static int find_data_references(struct reloc_control *rc,
 	}
 
 	key.objectid = ref_objectid;
-	key.offset = ref_offset;
 	key.type = BTRFS_EXTENT_DATA_KEY;
+	if (ref_offset > ((u64)-1 << 32))
+		key.offset = 0;
+	else
+		key.offset = ref_offset;

This needs comment, as we're working around a corner case and a magic number is used.

Quoted 4 lines
fs/btrfs/relocation.c +0 -1
 	path->search_commit_root = 1;
 	path->skip_locking = 1;
--