+++ /dev/null
-From f4428dfbae8cee287fcf7bc4ab5e7efdaeeac8ae Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 6 Jan 2026 20:26:40 +1030
-Subject: btrfs: send: check for inline extents in range_is_hole_in_parent()
-
-From: Qu Wenruo <wqu@suse.com>
-
-[ Upstream commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 ]
-
-Before accessing the disk_bytenr field of a file extent item we need
-to check if we are dealing with an inline extent.
-This is because for inline extents their data starts at the offset of
-the disk_bytenr field. So accessing the disk_bytenr
-means we are accessing inline data or in case the inline data is less
-than 8 bytes we can actually cause an invalid
-memory access if this inline extent item is the first item in the leaf
-or access metadata from other items.
-
-Fixes: 82bfb2e7b645 ("Btrfs: incremental send, fix unnecessary hole writes for sparse files")
-Reviewed-by: Filipe Manana <fdmanana@suse.com>
-Signed-off-by: Qu Wenruo <wqu@suse.com>
-Reviewed-by: David Sterba <dsterba@suse.com>
-Signed-off-by: David Sterba <dsterba@suse.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/btrfs/send.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
-index d86b4d13cae48..f144171ed6b7e 100644
---- a/fs/btrfs/send.c
-+++ b/fs/btrfs/send.c
-@@ -5892,6 +5892,8 @@ static int range_is_hole_in_parent(struct send_ctx *sctx,
- extent_end = btrfs_file_extent_end(path);
- if (extent_end <= start)
- goto next;
-+ if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE)
-+ return 0;
- if (btrfs_file_extent_disk_bytenr(leaf, fi) == 0) {
- search_start = extent_end;
- goto next;
---
-2.51.0
-
pnfs-flexfiles-fix-memory-leak-in-nfs4_ff_alloc_devi.patch
nvmet-tcp-remove-boilerplate-code.patch
nvme-tcp-fix-null-pointer-dereferences-in-nvmet_tcp_.patch
-btrfs-send-check-for-inline-extents-in-range_is_hole.patch
ip6_tunnel-use-skb_vlan_inet_prepare-in-__ip6_tnl_rc.patch
macvlan-add-nodst-option-to-macvlan-type-source.patch
macvlan-use-hash-iterators-to-simplify-code.patch
+++ /dev/null
-From 3f97e9a5e114017142ccae1a86b3481779f4cc92 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 6 Jan 2026 20:26:40 +1030
-Subject: btrfs: send: check for inline extents in range_is_hole_in_parent()
-
-From: Qu Wenruo <wqu@suse.com>
-
-[ Upstream commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 ]
-
-Before accessing the disk_bytenr field of a file extent item we need
-to check if we are dealing with an inline extent.
-This is because for inline extents their data starts at the offset of
-the disk_bytenr field. So accessing the disk_bytenr
-means we are accessing inline data or in case the inline data is less
-than 8 bytes we can actually cause an invalid
-memory access if this inline extent item is the first item in the leaf
-or access metadata from other items.
-
-Fixes: 82bfb2e7b645 ("Btrfs: incremental send, fix unnecessary hole writes for sparse files")
-Reviewed-by: Filipe Manana <fdmanana@suse.com>
-Signed-off-by: Qu Wenruo <wqu@suse.com>
-Reviewed-by: David Sterba <dsterba@suse.com>
-Signed-off-by: David Sterba <dsterba@suse.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/btrfs/send.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
-index a46076788bd7e..32992b2fdd384 100644
---- a/fs/btrfs/send.c
-+++ b/fs/btrfs/send.c
-@@ -5892,6 +5892,8 @@ static int range_is_hole_in_parent(struct send_ctx *sctx,
- extent_end = btrfs_file_extent_end(path);
- if (extent_end <= start)
- goto next;
-+ if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE)
-+ return 0;
- if (btrfs_file_extent_disk_bytenr(leaf, fi) == 0) {
- search_start = extent_end;
- goto next;
---
-2.51.0
-
can-etas_es58x-allow-partial-rx-urb-allocation-to-su.patch
nvmet-tcp-remove-boilerplate-code.patch
nvme-tcp-fix-null-pointer-dereferences-in-nvmet_tcp_.patch
-btrfs-send-check-for-inline-extents-in-range_is_hole.patch
ip6_tunnel-use-skb_vlan_inet_prepare-in-__ip6_tnl_rc.patch
net-update-netdev_lock_-type-name.patch
macvlan-fix-possible-uaf-in-macvlan_forward_source.patch
+++ /dev/null
-From 490ad73c778c85ee344947164934a2bb2913f757 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 6 Jan 2026 20:26:40 +1030
-Subject: btrfs: send: check for inline extents in range_is_hole_in_parent()
-
-From: Qu Wenruo <wqu@suse.com>
-
-[ Upstream commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 ]
-
-Before accessing the disk_bytenr field of a file extent item we need
-to check if we are dealing with an inline extent.
-This is because for inline extents their data starts at the offset of
-the disk_bytenr field. So accessing the disk_bytenr
-means we are accessing inline data or in case the inline data is less
-than 8 bytes we can actually cause an invalid
-memory access if this inline extent item is the first item in the leaf
-or access metadata from other items.
-
-Fixes: 82bfb2e7b645 ("Btrfs: incremental send, fix unnecessary hole writes for sparse files")
-Reviewed-by: Filipe Manana <fdmanana@suse.com>
-Signed-off-by: Qu Wenruo <wqu@suse.com>
-Reviewed-by: David Sterba <dsterba@suse.com>
-Signed-off-by: David Sterba <dsterba@suse.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/btrfs/send.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
-index f5a9f6689c460..486d4fcc597b2 100644
---- a/fs/btrfs/send.c
-+++ b/fs/btrfs/send.c
-@@ -6289,6 +6289,8 @@ static int range_is_hole_in_parent(struct send_ctx *sctx,
- extent_end = btrfs_file_extent_end(path);
- if (extent_end <= start)
- goto next;
-+ if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE)
-+ return 0;
- if (btrfs_file_extent_disk_bytenr(leaf, fi) == 0) {
- search_start = extent_end;
- goto next;
---
-2.51.0
-
can-etas_es58x-allow-partial-rx-urb-allocation-to-su.patch
nvmet-tcp-remove-boilerplate-code.patch
nvme-tcp-fix-null-pointer-dereferences-in-nvmet_tcp_.patch
-btrfs-send-check-for-inline-extents-in-range_is_hole.patch
ip6_tunnel-use-skb_vlan_inet_prepare-in-__ip6_tnl_rc.patch
net-update-netdev_lock_-type-name.patch
macvlan-fix-possible-uaf-in-macvlan_forward_source.patch