From 1a084d5209de6e3badab9d1572ab7cd6c9abdb4a Mon Sep 17 00:00:00 2001 From: Dan Rosenberg Date: Mon, 19 Jul 2010 16:58:20 -0400 Subject: [PATCH] --- yaml --- r: 201054 b: refs/heads/master c: 2ebc3464781ad24474abcbd2274e6254689853b5 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/fs/btrfs/ioctl.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/[refs] b/[refs] index 597be38cab19..666fc6721fd0 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: b5384d48f4e74edec3ca1887cb65e378a72af9a1 +refs/heads/master: 2ebc3464781ad24474abcbd2274e6254689853b5 diff --git a/trunk/fs/btrfs/ioctl.c b/trunk/fs/btrfs/ioctl.c index 2a8b3a7568ad..9254b3d58dbe 100644 --- a/trunk/fs/btrfs/ioctl.c +++ b/trunk/fs/btrfs/ioctl.c @@ -1458,7 +1458,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, */ /* the destination must be opened for writing */ - if (!(file->f_mode & FMODE_WRITE)) + if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) return -EINVAL; ret = mnt_want_write(file->f_path.mnt); @@ -1511,7 +1511,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, /* determine range to clone */ ret = -EINVAL; - if (off >= src->i_size || off + len > src->i_size) + if (off + len > src->i_size || off + len < off) goto out_unlock; if (len == 0) olen = len = src->i_size - off;