[v3,0/2] btrfs: fix logical_to_ino panic in btrfs_map_bio

Message

Boris Burkov June 1, 2023, 6:45 p.m. UTC

The gory details are in the second patch, but it is possible to panic
the kernel by running the ioctl BTRFS_IOC_LOGICAL_INO (and V2 of that
ioctl).

The TL;DR of the problem is that we do not properly handle logging a
move from a push_node_left btree balancing operation in the tree mod
log, so it is possible for backref walking using the tree mod log to
construct an invalid extent_buffer and ultimately try to map invalid
bios for block 0 which ultimately hits a null pointer error and panics.

The patch set introduces additional bookkeeping in tree mod log to warn
on this issue and also fixes the issue itself.

---
Changelog:
v3:
- fix bug from missing RB_CLEAR_NODE
- assert on move nr_items = 0 and max_slot < -1
- document max_slot with a comment
- change to ints for max_slot
- get rid of now redundant warning. max_slot=-1, move_dst_end=-1 is "OK"
  though it will assert.
- re-add max_slot setting after move that got lost in v2...
- remove unrelated formatting changes
v2:
- move WARN to before the bad memmove
- change WARN to WARN_ON + btrfs_warn
- fix tm freeing bug in tree_mod_log_insert_move
- unify error handling for tm alloc failures on setting tm=NULL after
  setting ret=PTR_ERR(tm) and then calling kfree unconditionally
- tidying/nits

Boris Burkov (2):
  btrfs: warn on invalid slot in tree mod log rewind
  btrfs: insert tree mod log move in push_node_left

 fs/btrfs/ctree.c        | 11 +++--
 fs/btrfs/tree-mod-log.c | 95 +++++++++++++++++++++++++++++++++++++----
 2 files changed, 93 insertions(+), 13 deletions(-)