btrfs-progs: check: Fix heap use after free

[platform/upstream/btrfs-progs.git] / file-item.c

diff --git a/file-item.c b/file-item.c
index f53a5ca..333fa33 100644 (file)
--- a/file-item.c
+++ b/file-item.c
@@ -25,6 +25,7 @@
 #include "transaction.h"
 #include "print-tree.h"
 #include "crc32c.h"
+#include "internal.h"
 
 #define MAX_CSUM_ITEMS(r,size) ((((BTRFS_LEAF_DATA_SIZE(r) - \
                               sizeof(struct btrfs_item) * 2) / \
@@ -35,16 +36,29 @@ int btrfs_insert_file_extent(struct btrfs_trans_handle *trans,
                             u64 disk_num_bytes, u64 num_bytes)
 {
        int ret = 0;
+       int is_hole = 0;
        struct btrfs_file_extent_item *item;
        struct btrfs_key file_key;
        struct btrfs_path *path;
        struct extent_buffer *leaf;
 
+       if (offset == 0)
+               is_hole = 1;
+       /* For NO_HOLES, we don't insert hole file extent */
+       if (btrfs_fs_incompat(root->fs_info, NO_HOLES) && is_hole)
+               return 0;
+
+       /* For hole, its disk_bytenr and disk_num_bytes must be 0 */
+       if (is_hole)
+               disk_num_bytes = 0;
+
        path = btrfs_alloc_path();
-       BUG_ON(!path);
+       if (!path)
+               return -ENOMEM;
+
        file_key.objectid = objectid;
        file_key.offset = pos;
-       btrfs_set_key_type(&file_key, BTRFS_EXTENT_DATA_KEY);
+       file_key.type = BTRFS_EXTENT_DATA_KEY;
 
        ret = btrfs_insert_empty_item(trans, root, path, &file_key,
                                      sizeof(*item));
@@ -89,7 +103,7 @@ int btrfs_insert_inline_extent(struct btrfs_trans_handle *trans,
 
        key.objectid = objectid;
        key.offset = offset;
-       btrfs_set_key_type(&key, BTRFS_EXTENT_DATA_KEY);
+       key.type = BTRFS_EXTENT_DATA_KEY;
 
        datasize = btrfs_file_extent_calc_inline_size(size);
        ret = btrfs_insert_empty_item(trans, root, path, &key, datasize);
@@ -134,7 +148,7 @@ btrfs_lookup_csum(struct btrfs_trans_handle *trans,
 
        file_key.objectid = BTRFS_EXTENT_CSUM_OBJECTID;
        file_key.offset = bytenr;
-       btrfs_set_key_type(&file_key, BTRFS_EXTENT_CSUM_KEY);
+       file_key.type = BTRFS_EXTENT_CSUM_KEY;
        ret = btrfs_search_slot(trans, root, &file_key, path, 0, cow);
        if (ret < 0)
                goto fail;
@@ -145,7 +159,7 @@ btrfs_lookup_csum(struct btrfs_trans_handle *trans,
                        goto fail;
                path->slots[0]--;
                btrfs_item_key_to_cpu(leaf, &found_key, path->slots[0]);
-               if (btrfs_key_type(&found_key) != BTRFS_EXTENT_CSUM_KEY)
+               if (found_key.type != BTRFS_EXTENT_CSUM_KEY)
                        goto fail;
 
                csum_offset = (bytenr - found_key.offset) / root->sectorsize;
@@ -187,7 +201,8 @@ int btrfs_csum_file_block(struct btrfs_trans_handle *trans,
                btrfs_super_csum_size(root->fs_info->super_copy);
 
        path = btrfs_alloc_path();
-       BUG_ON(!path);
+       if (!path)
+               return -ENOMEM;
 
        file_key.objectid = BTRFS_EXTENT_CSUM_OBJECTID;
        file_key.offset = bytenr;
@@ -262,7 +277,7 @@ int btrfs_csum_file_block(struct btrfs_trans_handle *trans,
                diff = diff - btrfs_item_size_nr(leaf, path->slots[0]);
                if (diff != csum_size)
                        goto insert;
-               ret = btrfs_extend_item(trans, root, path, diff);
+               ret = btrfs_extend_item(root, path, diff);
                BUG_ON(ret);
                goto csum;
        }
@@ -295,8 +310,8 @@ csum:
        item = (struct btrfs_csum_item *)((unsigned char *)item +
                                          csum_offset * csum_size);
 found:
-       csum_result = btrfs_csum_data(root, data, csum_result, len);
-       btrfs_csum_final(csum_result, (char *)&csum_result);
+       csum_result = btrfs_csum_data(data, csum_result, len);
+       btrfs_csum_final(csum_result, (u8 *)&csum_result);
        if (csum_result == 0) {
                printk("csum result is 0 for block %llu\n",
                       (unsigned long long)bytenr);
@@ -306,7 +321,6 @@ found:
                            csum_size);
        btrfs_mark_buffer_dirty(path->nodes[0]);
 fail:
-       btrfs_release_path(path);
        btrfs_free_path(path);
        return ret;
 }
@@ -322,8 +336,7 @@ fail:
  * This calls btrfs_truncate_item with the correct args based on the
  * overlap, and fixes up the key as required.
  */
-static noinline int truncate_one_csum(struct btrfs_trans_handle *trans,
-                                     struct btrfs_root *root,
+static noinline int truncate_one_csum(struct btrfs_root *root,
                                      struct btrfs_path *path,
                                      struct btrfs_key *key,
                                      u64 bytenr, u64 len)
@@ -350,7 +363,7 @@ static noinline int truncate_one_csum(struct btrfs_trans_handle *trans,
                 */
                u32 new_size = (bytenr - key->offset) / blocksize;
                new_size *= csum_size;
-               ret = btrfs_truncate_item(trans, root, path, new_size, 1);
+               ret = btrfs_truncate_item(root, path, new_size, 1);
                BUG_ON(ret);
        } else if (key->offset >= bytenr && csum_end > end_byte &&
                   end_byte > key->offset) {
@@ -363,11 +376,11 @@ static noinline int truncate_one_csum(struct btrfs_trans_handle *trans,
                u32 new_size = (csum_end - end_byte) / blocksize;
                new_size *= csum_size;
 
-               ret = btrfs_truncate_item(trans, root, path, new_size, 0);
+               ret = btrfs_truncate_item(root, path, new_size, 0);
                BUG_ON(ret);
 
                key->offset = end_byte;
-               ret = btrfs_set_item_key_safe(trans, root, path, key);
+               ret = btrfs_set_item_key_safe(root, path, key);
                BUG_ON(ret);
        } else {
                BUG();
@@ -475,8 +488,7 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
 
                        key.offset = end_byte - 1;
                } else {
-                       ret = truncate_one_csum(trans, root, path,
-                                               &key, bytenr, len);
+                       ret = truncate_one_csum(root, path, &key, bytenr, len);
                        BUG_ON(ret);
                }
                btrfs_release_path(path);