| Message ID | ae9556ccc1c06b17ea40f2e05b60cc4d8dcac0a7.1706130791.git.dsterba@suse.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Error handling fixes | expand |
On 2024/1/25 07:48, David Sterba wrote: > The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, > as it could be caused only by two impossible conditions: > > - at first the search key is set up to look for a chunk tree item, with > offset -1, this is an inexact search and the key->offset will contain > the correct offset upon a successful search, a valid chunk tree item > cannot have an offset -1 > > - after first successful search, the found_key corresponds to a chunk > item, the offset is decremented by 1 before the next loop, it's > impossible to find a chunk item there due to alignment and size > constraints > > Signed-off-by: David Sterba <dsterba@suse.com> > --- > fs/btrfs/volumes.c | 12 +++++++++++- > 1 file changed, 11 insertions(+), 1 deletion(-) > > diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c > index d67785be2c77..6aae92e4b424 100644 > --- a/fs/btrfs/volumes.c > +++ b/fs/btrfs/volumes.c > @@ -3393,7 +3393,17 @@ static int btrfs_relocate_sys_chunks(struct btrfs_fs_info *fs_info) > mutex_unlock(&fs_info->reclaim_bgs_lock); > goto error; > } > - BUG_ON(ret == 0); /* Corruption */ > + if (ret == 0) { > + /* > + * On the first search we would find chunk tree with > + * offset -1, which is not possible. On subsequent > + * loops this would find an existing item on an invalid > + * offset (one less than the previous one, wrong > + * alignment and size). > + */ > + ret = -EUCLEAN; > + goto error; This can be handled by adding new root item offset key check in tree-checker, then converting to an ASSERT(). Thanks, Qu > + } > > ret = btrfs_previous_item(chunk_root, path, key.objectid, > key.type);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index d67785be2c77..6aae92e4b424 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -3393,7 +3393,17 @@ static int btrfs_relocate_sys_chunks(struct btrfs_fs_info *fs_info) mutex_unlock(&fs_info->reclaim_bgs_lock); goto error; } - BUG_ON(ret == 0); /* Corruption */ + if (ret == 0) { + /* + * On the first search we would find chunk tree with + * offset -1, which is not possible. On subsequent + * loops this would find an existing item on an invalid + * offset (one less than the previous one, wrong + * alignment and size). + */ + ret = -EUCLEAN; + goto error; + } ret = btrfs_previous_item(chunk_root, path, key.objectid, key.type);
The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions: - at first the search key is set up to look for a chunk tree item, with offset -1, this is an inexact search and the key->offset will contain the correct offset upon a successful search, a valid chunk tree item cannot have an offset -1 - after first successful search, the found_key corresponds to a chunk item, the offset is decremented by 1 before the next loop, it's impossible to find a chunk item there due to alignment and size constraints Signed-off-by: David Sterba <dsterba@suse.com> --- fs/btrfs/volumes.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)