]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
btrfs: tree-checker: fix the incorrect inode ref size check
authorQu Wenruo <wqu@suse.com>
Mon, 15 Sep 2025 22:24:06 +0000 (07:54 +0930)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Sep 2025 08:58:52 +0000 (10:58 +0200)
commit8f8a08c82b638babca70cebc7c626026c79cf064
tree24d5f69fe10a7cabdf7cac9151a4877cc82a8d3a
parentba0e586d11088f4ac66a2493615a9d0b497818d5
btrfs: tree-checker: fix the incorrect inode ref size check

commit 96fa515e70f3e4b98685ef8cac9d737fc62f10e1 upstream.

[BUG]
Inside check_inode_ref(), we need to make sure every structure,
including the btrfs_inode_extref header, is covered by the item.  But
our code is incorrectly using "sizeof(iref)", where @iref is just a
pointer.

This means "sizeof(iref)" will always be "sizeof(void *)", which is much
smaller than "sizeof(struct btrfs_inode_extref)".

This will allow some bad inode extrefs to sneak in, defeating tree-checker.

[FIX]
Fix the typo by calling "sizeof(*iref)", which is the same as
"sizeof(struct btrfs_inode_extref)", and will be the correct behavior we
want.

Fixes: 71bf92a9b877 ("btrfs: tree-checker: Add check for INODE_REF")
CC: stable@vger.kernel.org # 6.1+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/btrfs/tree-checker.c