1 files changed, 14 insertions, 0 deletions

diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
index db835635372f..cab0b1f1f741 100644
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -487,6 +487,13 @@ static int check_leaf(struct btrfs_fs_info *fs_info, struct extent_buffer *leaf,
         u32 nritems = btrfs_header_nritems(leaf);
         int slot;
 
+        if (btrfs_header_level(leaf) != 0) {
+                generic_err(fs_info, leaf, 0,
+                        "invalid level for leaf, have %d expect 0",
+                        btrfs_header_level(leaf));
+                return -EUCLEAN;
+        }
+
         /*
          * Extent buffers from a relocation tree have a owner field that
          * corresponds to the subvolume tree they are based on. So just from an
@@ -645,9 +652,16 @@ int btrfs_check_node(struct btrfs_fs_info *fs_info, struct extent_buffer *node)
         unsigned long nr = btrfs_header_nritems(node);
         struct btrfs_key key, next_key;
         int slot;
+        int level = btrfs_header_level(node);
         u64 bytenr;
         int ret = 0;
 
+        if (level <= 0 || level >= BTRFS_MAX_LEVEL) {
+                generic_err(fs_info, node, 0,
+                        "invalid level for node, have %d expect [1, %d]",
+                        level, BTRFS_MAX_LEVEL - 1);
+                return -EUCLEAN;
+        }
         if (nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(fs_info)) {
                 btrfs_crit(fs_info,
 "corrupt node: root=%llu block=%llu, nritems too %s, have %lu expect range [1,%u]",