github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-13 15:40:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

btrfs: tree-checker: validate key offset for inode ref keys

Browse Source 
For a subvolume tree, the offset of an inode ref key corresponds to an
inode number, and that must always be within the range:

  [ BTRFS_FIRST_FREE_OBJECTID (256), BTRFS_LAST_FREE_OBJECTID (-256) ]

Add a check for that in check_inode_ref(). Sashiko complained about such
check missing in another unrelated patch.

Reviewed-by: Boris Burkov <boris@bur.io>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
Filipe Manana 2026-09-03 16:16:32 +01:00 committed by David Sterba
parent 36f9aafa46
commit 2a4513ab53
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/btrfs/tree-checker.c
View File

@ -1909,6 +1909,16 @@ static int check_inode_ref(struct extent_buffer *leaf,
return -EUCLEAN;
}
if (unlikely(btrfs_is_fstree(btrfs_header_owner(leaf)) &&
(key->offset < BTRFS_FIRST_FREE_OBJECTID ||
key->offset > BTRFS_LAST_FREE_OBJECTID))) {
inode_ref_err(leaf, slot,
"invalid offset for ref key, have %llu expect [%llu, %lld]",
key->offset, BTRFS_FIRST_FREE_OBJECTID,
BTRFS_LAST_FREE_OBJECTID);
return -EUCLEAN;
}
ptr = btrfs_item_ptr_offset(leaf, slot);
end = ptr + btrfs_item_size(leaf, slot);
while (ptr < end) {