From 414b52b59e69a43a29f1958f7a23ffca0c22d283 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 5 Feb 2026 15:07:41 +0100 Subject: [PATCH] drop btrfs-send-check-for-inline-extents-in-range_is_hole.patch --- ...-for-inline-extents-in-range_is_hole.patch | 44 ------------------- queue-5.10/series | 1 - ...-for-inline-extents-in-range_is_hole.patch | 44 ------------------- queue-5.15/series | 1 - ...-for-inline-extents-in-range_is_hole.patch | 44 ------------------- queue-6.1/series | 1 - 6 files changed, 135 deletions(-) delete mode 100644 queue-5.10/btrfs-send-check-for-inline-extents-in-range_is_hole.patch delete mode 100644 queue-5.15/btrfs-send-check-for-inline-extents-in-range_is_hole.patch delete mode 100644 queue-6.1/btrfs-send-check-for-inline-extents-in-range_is_hole.patch diff --git a/queue-5.10/btrfs-send-check-for-inline-extents-in-range_is_hole.patch b/queue-5.10/btrfs-send-check-for-inline-extents-in-range_is_hole.patch deleted file mode 100644 index eec2651ccf..0000000000 --- a/queue-5.10/btrfs-send-check-for-inline-extents-in-range_is_hole.patch +++ /dev/null @@ -1,44 +0,0 @@ -From f4428dfbae8cee287fcf7bc4ab5e7efdaeeac8ae Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Jan 2026 20:26:40 +1030 -Subject: btrfs: send: check for inline extents in range_is_hole_in_parent() - -From: Qu Wenruo - -[ Upstream commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 ] - -Before accessing the disk_bytenr field of a file extent item we need -to check if we are dealing with an inline extent. -This is because for inline extents their data starts at the offset of -the disk_bytenr field. So accessing the disk_bytenr -means we are accessing inline data or in case the inline data is less -than 8 bytes we can actually cause an invalid -memory access if this inline extent item is the first item in the leaf -or access metadata from other items. - -Fixes: 82bfb2e7b645 ("Btrfs: incremental send, fix unnecessary hole writes for sparse files") -Reviewed-by: Filipe Manana -Signed-off-by: Qu Wenruo -Reviewed-by: David Sterba -Signed-off-by: David Sterba -Signed-off-by: Sasha Levin ---- - fs/btrfs/send.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c -index d86b4d13cae48..f144171ed6b7e 100644 ---- a/fs/btrfs/send.c -+++ b/fs/btrfs/send.c -@@ -5892,6 +5892,8 @@ static int range_is_hole_in_parent(struct send_ctx *sctx, - extent_end = btrfs_file_extent_end(path); - if (extent_end <= start) - goto next; -+ if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE) -+ return 0; - if (btrfs_file_extent_disk_bytenr(leaf, fi) == 0) { - search_start = extent_end; - goto next; --- -2.51.0 - diff --git a/queue-5.10/series b/queue-5.10/series index 6398170e12..3b6661038f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1,7 +1,6 @@ pnfs-flexfiles-fix-memory-leak-in-nfs4_ff_alloc_devi.patch nvmet-tcp-remove-boilerplate-code.patch nvme-tcp-fix-null-pointer-dereferences-in-nvmet_tcp_.patch -btrfs-send-check-for-inline-extents-in-range_is_hole.patch ip6_tunnel-use-skb_vlan_inet_prepare-in-__ip6_tnl_rc.patch macvlan-add-nodst-option-to-macvlan-type-source.patch macvlan-use-hash-iterators-to-simplify-code.patch diff --git a/queue-5.15/btrfs-send-check-for-inline-extents-in-range_is_hole.patch b/queue-5.15/btrfs-send-check-for-inline-extents-in-range_is_hole.patch deleted file mode 100644 index 3acd211601..0000000000 --- a/queue-5.15/btrfs-send-check-for-inline-extents-in-range_is_hole.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 3f97e9a5e114017142ccae1a86b3481779f4cc92 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Jan 2026 20:26:40 +1030 -Subject: btrfs: send: check for inline extents in range_is_hole_in_parent() - -From: Qu Wenruo - -[ Upstream commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 ] - -Before accessing the disk_bytenr field of a file extent item we need -to check if we are dealing with an inline extent. -This is because for inline extents their data starts at the offset of -the disk_bytenr field. So accessing the disk_bytenr -means we are accessing inline data or in case the inline data is less -than 8 bytes we can actually cause an invalid -memory access if this inline extent item is the first item in the leaf -or access metadata from other items. - -Fixes: 82bfb2e7b645 ("Btrfs: incremental send, fix unnecessary hole writes for sparse files") -Reviewed-by: Filipe Manana -Signed-off-by: Qu Wenruo -Reviewed-by: David Sterba -Signed-off-by: David Sterba -Signed-off-by: Sasha Levin ---- - fs/btrfs/send.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c -index a46076788bd7e..32992b2fdd384 100644 ---- a/fs/btrfs/send.c -+++ b/fs/btrfs/send.c -@@ -5892,6 +5892,8 @@ static int range_is_hole_in_parent(struct send_ctx *sctx, - extent_end = btrfs_file_extent_end(path); - if (extent_end <= start) - goto next; -+ if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE) -+ return 0; - if (btrfs_file_extent_disk_bytenr(leaf, fi) == 0) { - search_start = extent_end; - goto next; --- -2.51.0 - diff --git a/queue-5.15/series b/queue-5.15/series index 03340db878..7cd24303e6 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -2,7 +2,6 @@ pnfs-flexfiles-fix-memory-leak-in-nfs4_ff_alloc_devi.patch can-etas_es58x-allow-partial-rx-urb-allocation-to-su.patch nvmet-tcp-remove-boilerplate-code.patch nvme-tcp-fix-null-pointer-dereferences-in-nvmet_tcp_.patch -btrfs-send-check-for-inline-extents-in-range_is_hole.patch ip6_tunnel-use-skb_vlan_inet_prepare-in-__ip6_tnl_rc.patch net-update-netdev_lock_-type-name.patch macvlan-fix-possible-uaf-in-macvlan_forward_source.patch diff --git a/queue-6.1/btrfs-send-check-for-inline-extents-in-range_is_hole.patch b/queue-6.1/btrfs-send-check-for-inline-extents-in-range_is_hole.patch deleted file mode 100644 index 4529f5fb82..0000000000 --- a/queue-6.1/btrfs-send-check-for-inline-extents-in-range_is_hole.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 490ad73c778c85ee344947164934a2bb2913f757 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Jan 2026 20:26:40 +1030 -Subject: btrfs: send: check for inline extents in range_is_hole_in_parent() - -From: Qu Wenruo - -[ Upstream commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 ] - -Before accessing the disk_bytenr field of a file extent item we need -to check if we are dealing with an inline extent. -This is because for inline extents their data starts at the offset of -the disk_bytenr field. So accessing the disk_bytenr -means we are accessing inline data or in case the inline data is less -than 8 bytes we can actually cause an invalid -memory access if this inline extent item is the first item in the leaf -or access metadata from other items. - -Fixes: 82bfb2e7b645 ("Btrfs: incremental send, fix unnecessary hole writes for sparse files") -Reviewed-by: Filipe Manana -Signed-off-by: Qu Wenruo -Reviewed-by: David Sterba -Signed-off-by: David Sterba -Signed-off-by: Sasha Levin ---- - fs/btrfs/send.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c -index f5a9f6689c460..486d4fcc597b2 100644 ---- a/fs/btrfs/send.c -+++ b/fs/btrfs/send.c -@@ -6289,6 +6289,8 @@ static int range_is_hole_in_parent(struct send_ctx *sctx, - extent_end = btrfs_file_extent_end(path); - if (extent_end <= start) - goto next; -+ if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE) -+ return 0; - if (btrfs_file_extent_disk_bytenr(leaf, fi) == 0) { - search_start = extent_end; - goto next; --- -2.51.0 - diff --git a/queue-6.1/series b/queue-6.1/series index ca973308bf..716e71fce9 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -6,7 +6,6 @@ pnfs-flexfiles-fix-memory-leak-in-nfs4_ff_alloc_devi.patch can-etas_es58x-allow-partial-rx-urb-allocation-to-su.patch nvmet-tcp-remove-boilerplate-code.patch nvme-tcp-fix-null-pointer-dereferences-in-nvmet_tcp_.patch -btrfs-send-check-for-inline-extents-in-range_is_hole.patch ip6_tunnel-use-skb_vlan_inet_prepare-in-__ip6_tnl_rc.patch net-update-netdev_lock_-type-name.patch macvlan-fix-possible-uaf-in-macvlan_forward_source.patch -- 2.47.3