Skip to content

Commit

Permalink
btrfs: fix invalid leaf access due to inline extent during lseek
Browse files Browse the repository at this point in the history
During lseek, for SEEK_DATA and SEEK_HOLE modes, we access the disk_bytenr
of an extent without checking its type. However inline extents have their
data starting the offset of the disk_bytenr field, so accessing that field
when we have an inline extent can result in either of the following:

1) Interpret the inline extent's data as a disk_bytenr value;

2) In case the inline data is less than 8 bytes, we access part of some
   other item in the leaf, or unused space in the leaf;

3) In case the inline data is less than 8 bytes and the extent item is
   the first item in the leaf, we can access beyond the leaf's limit.

So fix this by not accessing the disk_bytenr field if we have an inline
extent.

Fixes: b6e8335 ("btrfs: make hole and data seeking a lot more efficient")
Reported-by: Matthias Schoepfer <[email protected]>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216908
Link: https://lore.kernel.org/linux-btrfs/[email protected]/
CC: [email protected] # 6.1
Signed-off-by: Filipe Manana <[email protected]>
Reviewed-by: David Sterba <[email protected]>
Signed-off-by: David Sterba <[email protected]>
  • Loading branch information
fdmanana authored and kdave committed Jan 16, 2023
1 parent 26ecf24 commit 1f55ee6
Showing 1 changed file with 10 additions and 3 deletions.
13 changes: 10 additions & 3 deletions fs/btrfs/file.c

0 comments on commit 1f55ee6

Please sign in to comment.