From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C95079E3; Tue, 5 Dec 2023 03:31:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2eUcMtFb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1C88C433C8; Tue, 5 Dec 2023 03:31:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1701747065; bh=xCkSG9mU6kO1F/ac7YovhySDZQuaIsXguzyID6BR19A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2eUcMtFbO15adYP0P1dL/B1gUEep2EmZOlT0CS6vyHpoFh2+gqW1GX4vXqLMVogJC f4OaP1GkGqH7TJY0Rrq+pHqJMn1L2AjysOr/OhNwc29OSzriISnZ21OVV5DYCthCDF 42iaaIWiuHV4Cj3jlaVbs9bfBWPAMOEs8BNvK/gU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Josef Bacik , Filipe Manana , David Sterba Subject: [PATCH 6.1 046/107] btrfs: fix off-by-one when checking chunk map includes logical address Date: Tue, 5 Dec 2023 12:16:21 +0900 Message-ID: <20231205031534.216003897@linuxfoundation.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231205031531.426872356@linuxfoundation.org> References: <20231205031531.426872356@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Filipe Manana commit 5fba5a571858ce2d787fdaf55814e42725bfa895 upstream. At btrfs_get_chunk_map() we get the extent map for the chunk that contains the given logical address stored in the 'logical' argument. Then we do sanity checks to verify the extent map contains the logical address. One of these checks verifies if the extent map covers a range with an end offset behind the target logical address - however this check has an off-by-one error since it will consider an extent map whose start offset plus its length matches the target logical address as inclusive, while the fact is that the last byte it covers is behind the target logical address (by 1). So fix this condition by using '<=' rather than '<' when comparing the extent map's "start + length" against the target logical address. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/volumes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -3079,7 +3079,7 @@ struct extent_map *btrfs_get_chunk_map(s return ERR_PTR(-EINVAL); } - if (em->start > logical || em->start + em->len < logical) { + if (em->start > logical || em->start + em->len <= logical) { btrfs_crit(fs_info, "found a bad mapping, wanted %llu-%llu, found %llu-%llu", logical, length, em->start, em->start + em->len);