This is a note to let you know that I've just added the patch titled
btrfs: fix off-by-one when checking chunk map includes logical address
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
btrfs-fix-off-by-one-when-checking-chunk-map-includes-logical-address.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 5fba5a571858ce2d787fdaf55814e42725bfa895 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@xxxxxxxx>
Date: Tue, 21 Nov 2023 13:38:32 +0000
Subject: btrfs: fix off-by-one when checking chunk map includes logical address
From: Filipe Manana <fdmanana@xxxxxxxx>
commit 5fba5a571858ce2d787fdaf55814e42725bfa895 upstream.
At btrfs_get_chunk_map() we get the extent map for the chunk that contains
the given logical address stored in the 'logical' argument. Then we do
sanity checks to verify the extent map contains the logical address. One
of these checks verifies if the extent map covers a range with an end
offset behind the target logical address - however this check has an
off-by-one error since it will consider an extent map whose start offset
plus its length matches the target logical address as inclusive, while
the fact is that the last byte it covers is behind the target logical
address (by 1).
So fix this condition by using '<=' rather than '<' when comparing the
extent map's "start + length" against the target logical address.
CC: stable@xxxxxxxxxxxxxxx # 4.14+
Reviewed-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Filipe Manana <fdmanana@xxxxxxxx>
Reviewed-by: David Sterba <dsterba@xxxxxxxx>
Signed-off-by: David Sterba <dsterba@xxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/btrfs/volumes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3050,7 +3050,7 @@ struct extent_map *btrfs_get_chunk_map(s
return ERR_PTR(-EINVAL);
}
- if (em->start > logical || em->start + em->len < logical) {
+ if (em->start > logical || em->start + em->len <= logical) {
btrfs_crit(fs_info,
"found a bad mapping, wanted %llu-%llu, found %llu-%llu",
logical, length, em->start, em->start + em->len);
Patches currently in stable-queue which might be from fdmanana@xxxxxxxx are
queue-6.6/btrfs-fix-off-by-one-when-checking-chunk-map-includes-logical-address.patch
queue-6.6/btrfs-fix-64bit-compat-send-ioctl-arguments-not-initializing-version-member.patch
queue-6.6/btrfs-make-error-messages-more-clear-when-getting-a-chunk-map.patch
queue-6.6/btrfs-free-the-allocated-memory-if-btrfs_alloc_page_array-fails.patch
