diff options
| author | Qu Wenruo <wqu@suse.com> | 2026-06-23 21:07:15 +0930 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2026-07-14 07:03:15 +0200 |
| commit | 800b51960215417752f6712ce7e384ca49ecff39 (patch) | |
| tree | ad6d0a01aa0f8fa511a4f75b279f7f78218568db /fs/btrfs | |
| parent | ae4316f332e03e628712e9dfb89f2b7d3c70c21a (diff) | |
| download | linux-800b51960215417752f6712ce7e384ca49ecff39.tar.gz linux-800b51960215417752f6712ce7e384ca49ecff39.tar.bz2 linux-800b51960215417752f6712ce7e384ca49ecff39.zip | |
btrfs: reject inline file extents item in get_new_location()
Commit a6908f88c9da ("btrfs: validate data reloc tree file extent item
members") introduced extra checks on file extent items for data reloc
inodes, but it checked the file extent offset without checking if the file
extent is inlined.
This can lead to either false alerts (as the offset member is inside the
inlined data) or even reading beyond the item range.
This has already triggered a warning in a syzbot report.
Although the root fix is to avoid compression for data reloc inodes, for
the sake of consistency, reject inlined file extents first.
Fixes: a6908f88c9da ("btrfs: validate data reloc tree file extent item members")
CC: stable@vger.kernel.org
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/btrfs')
| -rw-r--r-- | fs/btrfs/relocation.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index 75bf2e5fcb6e..6409c2cc1926 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -890,6 +890,13 @@ static int get_new_location(struct inode *reloc_inode, u64 *new_bytenr, leaf = path->nodes[0]; fi = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_file_extent_item); + if (unlikely(btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE)) { + btrfs_print_leaf(leaf); + btrfs_err(fs_info, + "unexpected inline file extent item for data reloc inode %llu key offset %llu", + btrfs_ino(BTRFS_I(reloc_inode)), bytenr); + return -EUCLEAN; + } /* * The cluster-boundary key searched above is always written by |