Hello,
When truncating a inline extent, btrfs_drop_extents doesn't properly
handle the case "key.offset > inline_limit". This bug can only happen
when max line size is larger than 8K.
Attachment is the test case.
Regards
YZ
---
diff -r 96b323332c3b file.c
--- a/file.c Tue Jan 29 16:06:37 2008 -0500
+++ b/file.c Thu Jan 31 00:39:29 2008 +0800
@@ -591,8 +591,7 @@ next_slot:
}
}
bookend = 1;
- if (found_inline && start <= key.offset &&
- inline_limit < extent_end)
+ if (found_inline && start <= key.offset)
keep = 1;
}
/* truncate existing extent */
@@ -672,11 +671,10 @@ next_slot:
if (!bookend)
continue;
}
- if (bookend && found_inline && start <= key.offset &&
- inline_limit < extent_end && key.offset <= inline_limit) {
+ if (bookend && found_inline && start <= key.offset) {
u32 new_size;
new_size = btrfs_file_extent_calc_inline_size(
- extent_end - inline_limit);
+ extent_end - end);
btrfs_truncate_item(trans, root, path, new_size, 0);
}
/* create bookend, splitting the extent in two */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
int fd;
int ret;
char buf[8192];
fd = open(argv[1], O_RDWR | O_CREAT | O_EXCL, 0644);
if (fd < 0) {
perror("open");
exit(1);
}
/* create inline extent */
ret = pwrite(fd, buf, 1024 * 6, 4096);
if (ret < 0) {
perror("write");
exit(1);
}
/* disable packing of data */
ret = pwrite(fd, buf, 4096, 32768);
if (ret < 0) {
perror("write");
exit(1);
}
/* drop file extents in range 0 ~ 8192 */
ret = pwrite(fd, buf, 8192, 0);
if (ret < 0) {
perror("write");
exit(1);
}
close(fd);
return 0;
}
_______________________________________________
Btrfs-devel mailing list
[email protected]
http://oss.oracle.com/mailman/listinfo/btrfs-devel
