[Devel] [PATCH RHEL9 COMMIT] fs/ext4: bug in swapext ioctl

[Konstantin Khorenko]

The commit is pushed to "branch-rh9-5.14.0-427.44.1.vz9.80.x-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git
after rh9-5.14.0-427.44.1.vz9.80.17
------>
commit 00d0a1384a4ed7ad099043a0ca3908a9c561d310
Author: Alexey Kuznetsov <kuznet at virtuozzo.com>
Date:   Fri Feb 21 00:56:10 2025 +0800

    fs/ext4: bug in swapext ioctl
    
    Stupid and very dangerous mistake. Plain luck it did not result
    in corruptions, was exposed as failure to convert csd journal
    from old to new format.
    
    Fixes: 6380f9df0f67 ("fs/ext4: swapext ioctl")
    Affects: #VSTOR-100610
    https://virtuozzo.atlassian.net/browse/VSTOR-100610
    
    Signed-off-by: Alexey Kuznetsov <kuznet at virtuozzo.com>
    
    Feature: ext4: swapext ioctl: swap range of blocks between two files
---
 fs/ext4/move_extent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index aa9b6329e4af..9210fbd86d5e 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -941,7 +941,7 @@ ext4_ioc_swap_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
 			goto out;
 		}
 		if (cur_blk < d_start) {
-			cur_len -= cur_blk - d_start;
+			cur_len -= d_start - cur_blk;
 			cur_blk = d_start;
 		}
 		if (cur_blk + cur_len > d_end)