diff options
| author | Yan, Zheng <zheng.z.yan@intel.com> | 2011-08-29 09:25:53 +0800 |
|---|---|---|
| committer | David Sterba <dsterba@suse.cz> | 2011-10-20 18:10:31 +0200 |
| commit | 84850e8d8a5ec7b9d3c47d224e9a10c9da52ff1b (patch) | |
| tree | 799dd9e0b150361dc2a5cdf3772a0ce8395d5f06 /fs/btrfs/relocation.c | |
| parent | 016fc6a63e465d5b94e4028f6d05d9703e195428 (diff) | |
| download | op-kernel-dev-84850e8d8a5ec7b9d3c47d224e9a10c9da52ff1b.zip op-kernel-dev-84850e8d8a5ec7b9d3c47d224e9a10c9da52ff1b.tar.gz | |
btrfs: check file extent backref offset underflow
Offset field in data extent backref can underflow if clone range ioctl
is used. We can reliably detect the underflow because max file size is
limited to 2^63 and max data extent size is limited by block group size.
Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
Diffstat (limited to 'fs/btrfs/relocation.c')
| -rw-r--r-- | fs/btrfs/relocation.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index 10af6a0..24d654c 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -3322,8 +3322,11 @@ static int find_data_references(struct reloc_control *rc, } key.objectid = ref_objectid; - key.offset = ref_offset; key.type = BTRFS_EXTENT_DATA_KEY; + if (ref_offset > ((u64)-1 << 32)) + key.offset = 0; + else + key.offset = ref_offset; path->search_commit_root = 1; path->skip_locking = 1; |
