1 files changed, 27 insertions, 5 deletions

diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 4793f36f6518..73a11ccfd4c2 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -2436,16 +2436,26 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
                 len = min((u64)cpos + clusters, le64_to_cpu(rec.r_cpos) +
                           le32_to_cpu(rec.r_clusters)) - cpos;
                 /*
-                 * If the refcount rec already exist, cool. We just need
-                 * to check whether there is a split. Otherwise we just need
-                 * to increase the refcount.
-                 * If we will insert one, increases recs_add.
-                 *
                  * We record all the records which will be inserted to the
                  * same refcount block, so that we can tell exactly whether
                  * we need a new refcount block or not.
+                 *
+                 * If we will insert a new one, this is easy and only happens
+                 * during adding refcounted flag to the extent, so we don't
+                 * have a chance of spliting. We just need one record.
+                 *
+                 * If the refcount rec already exists, that would be a little
+                 * complicated. we may have to:
+                 * 1) split at the beginning if the start pos isn't aligned.
+                 *    we need 1 more record in this case.
+                 * 2) split int the end if the end pos isn't aligned.
+                 *    we need 1 more record in this case.
+                 * 3) split in the middle because of file system fragmentation.
+                 *    we need 2 more records in this case(we can't detect this
+                 *    beforehand, so always think of the worst case).
                  */
                 if (rec.r_refcount) {
+                        recs_add += 2;
                         /* Check whether we need a split at the beginning. */
                         if (cpos == start_cpos &&
                             cpos != le64_to_cpu(rec.r_cpos))
@@ -2931,6 +2941,12 @@ static int ocfs2_duplicate_clusters_by_page(handle_t *handle,
 
         offset = ((loff_t)cpos) << OCFS2_SB(sb)->s_clustersize_bits;
         end = offset + (new_len << OCFS2_SB(sb)->s_clustersize_bits);
+        /*
+         * We only duplicate pages until we reach the page contains i_size - 1.
+         * So trim 'end' to i_size.
+         */
+        if (end > i_size_read(context->inode))
+                end = i_size_read(context->inode);
 
         while (offset < end) {
                 page_index = offset >> PAGE_CACHE_SHIFT;
@@ -4166,6 +4182,12 @@ static int __ocfs2_reflink(struct dentry *old_dentry,
         struct inode *inode = old_dentry->d_inode;
         struct buffer_head *new_bh = NULL;
 
+        if (OCFS2_I(inode)->ip_flags & OCFS2_INODE_SYSTEM_FILE) {
+                ret = -EINVAL;
+                mlog_errno(ret);
+                goto out;
+        }
+
         ret = filemap_fdatawrite(inode->i_mapping);
         if (ret) {
                 mlog_errno(ret);