linux-kernel - Re: [PATCH] btrfs: tree-checker: Fix bounds check in check_inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <34156b7a-b8b4-4f0a-8379-f212951b8d57@suse.com>
Date: Thu, 9 Oct 2025 07:57:56 +1030
From: Qu Wenruo <wqu@...e.com>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: Chris Mason <clm@...com>, David Sterba <dsterba@...e.com>,
 Filipe Manana <fdmanana@...e.com>, linux-btrfs@...r.kernel.org,
 linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] btrfs: tree-checker: Fix bounds check in
 check_inode_extref()



在 2025/10/9 01:38, Dan Carpenter 写道:
> The parentheses for the unlikely() annotation were put in the wrong
> place so it means that the condition is basically never true and the
> bounds checking is skipped.
> 
> Fixes: aab9458b9f00 ("btrfs: tree-checker: add inode extref checks")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>

Nice catch.

Reviewed-by: Qu Wenruo <wqu@...e.com>

Thanks,
Qu

> ---
>   fs/btrfs/tree-checker.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
> index ca30b15ea452..c10b4c242acf 100644
> --- a/fs/btrfs/tree-checker.c
> +++ b/fs/btrfs/tree-checker.c
> @@ -1797,7 +1797,7 @@ static int check_inode_extref(struct extent_buffer *leaf,
>   		struct btrfs_inode_extref *extref = (struct btrfs_inode_extref *)ptr;
>   		u16 namelen;
>   
> -		if (unlikely(ptr + sizeof(*extref)) > end) {
> +		if (unlikely(ptr + sizeof(*extref) > end)) {
>   			inode_ref_err(leaf, slot,
>   			"inode extref overflow, ptr %lu end %lu inode_extref size %zu",
>   				      ptr, end, sizeof(*extref));