[v4,0/2] btrfs: fix logical_to_ino panic in btrfs_map_bio

Message

Boris Burkov June 1, 2023, 6:55 p.m. UTC

The gory details are in the second patch, but it is possible to panic
the kernel by running the ioctl BTRFS_IOC_LOGICAL_INO (and V2 of that
ioctl).

The TL;DR of the problem is that we do not properly handle logging a
move from a push_node_left btree balancing operation in the tree mod
log, so it is possible for backref walking using the tree mod log to
construct an invalid extent_buffer and ultimately try to map invalid
bios for block 0 which ultimately hits a null pointer error and panics.

The patch set introduces additional bookkeeping in tree mod log to warn
on this issue and also fixes the issue itself.

---
Changelog:
v4:
- actually include the changes to Patch 1 cited in v3, my mistake.
v3:
- fix bug from missing RB_CLEAR_NODE
- assert on move nr_items = 0 and max_slot < -1
- document max_slot with a comment
- change to ints for max_slot
- get rid of now redundant warning. max_slot=-1, move_dst_end=-1 is "OK"
  though it will assert.
- re-add max_slot setting after move that got lost in v2...
- remove unrelated formatting changes
v2:
- move WARN to before the bad memmove
- change WARN to WARN_ON + btrfs_warn
- fix tm freeing bug in tree_mod_log_insert_move
- unify error handling for tm alloc failures on setting tm=NULL after
  setting ret=PTR_ERR(tm) and then calling kfree unconditionally
- tidying/nits

Boris Burkov (2):
  btrfs: warn on invalid slot in tree mod log rewind
  btrfs: insert tree mod log move in push_node_left

 fs/btrfs/ctree.c        |  11 ++--
 fs/btrfs/tree-mod-log.c | 114 ++++++++++++++++++++++++++++++++++++----
 2 files changed, 112 insertions(+), 13 deletions(-)

Comments

David Sterba June 2, 2023, 8:07 p.m. UTC | #1

On Thu, Jun 01, 2023 at 11:55:12AM -0700, Boris Burkov wrote:
> The gory details are in the second patch, but it is possible to panic
> the kernel by running the ioctl BTRFS_IOC_LOGICAL_INO (and V2 of that
> ioctl).
> 
> The TL;DR of the problem is that we do not properly handle logging a
> move from a push_node_left btree balancing operation in the tree mod
> log, so it is possible for backref walking using the tree mod log to
> construct an invalid extent_buffer and ultimately try to map invalid
> bios for block 0 which ultimately hits a null pointer error and panics.
> 
> The patch set introduces additional bookkeeping in tree mod log to warn
> on this issue and also fixes the issue itself.
> 
> ---
> Changelog:
> v4:
> - actually include the changes to Patch 1 cited in v3, my mistake.

Added to misc-next, thanks.