1 files changed, 4 insertions, 3 deletions

diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index da6e9364a5e..9197e2e3340 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -1032,6 +1032,7 @@ continue_with_current_leaf_stack_frame:
                         struct btrfs_disk_key *disk_key;
                         u8 type;
                         u32 item_offset;
+                        u32 item_size;
 
                         if (disk_item_offset + sizeof(struct btrfs_item) >
                             sf->block_ctx->len) {
@@ -1047,6 +1048,7 @@ leaf_item_out_of_bounce_error:
                                                      disk_item_offset,
                                                      sizeof(struct btrfs_item));
                         item_offset = le32_to_cpu(disk_item.offset);
+                        item_size = le32_to_cpu(disk_item.size);
                         disk_key = &disk_item.key;
                         type = disk_key->type;
 
@@ -1057,14 +1059,13 @@ leaf_item_out_of_bounce_error:
 
                                 root_item_offset = item_offset +
                                         offsetof(struct btrfs_leaf, items);
-                                if (root_item_offset +
-                                    sizeof(struct btrfs_root_item) >
+                                if (root_item_offset + item_size >
                                     sf->block_ctx->len)
                                         goto leaf_item_out_of_bounce_error;
                                 btrfsic_read_from_block_data(
                                         sf->block_ctx, &root_item,
                                         root_item_offset,
-                                        sizeof(struct btrfs_root_item));
+                                        item_size);
                                 next_bytenr = le64_to_cpu(root_item.bytenr);
 
                                 sf->error =