Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wirel...

[~andy/linux] / fs / btrfs / check-integrity.c

diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index da6e9364a5e3caa48b67c5e17f95a21ded5ee9ec..9197e2e33407d26f67a91196ae95328840e3f6ce 100644 (file)
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -1032,6 +1032,7 @@ continue_with_current_leaf_stack_frame:
                        struct btrfs_disk_key *disk_key;
                        u8 type;
                        u32 item_offset;
+                       u32 item_size;
 
                        if (disk_item_offset + sizeof(struct btrfs_item) >
                            sf->block_ctx->len) {
@@ -1047,6 +1048,7 @@ leaf_item_out_of_bounce_error:
                                                     disk_item_offset,
                                                     sizeof(struct btrfs_item));
                        item_offset = le32_to_cpu(disk_item.offset);
+                       item_size = le32_to_cpu(disk_item.size);
                        disk_key = &disk_item.key;
                        type = disk_key->type;
 
@@ -1057,14 +1059,13 @@ leaf_item_out_of_bounce_error:
 
                                root_item_offset = item_offset +
                                        offsetof(struct btrfs_leaf, items);
-                               if (root_item_offset +
-                                   sizeof(struct btrfs_root_item) >
+                               if (root_item_offset + item_size >
                                    sf->block_ctx->len)
                                        goto leaf_item_out_of_bounce_error;
                                btrfsic_read_from_block_data(
                                        sf->block_ctx, &root_item,
                                        root_item_offset,
-                                       sizeof(struct btrfs_root_item));
+                                       item_size);
                                next_bytenr = le64_to_cpu(root_item.bytenr);
 
                                sf->error =