corrupted root csum tree result in segfault.

# mkfs.btrfs /dev/sdd && btrfs-debug-tree -R /dev/sdd | egrep checksum

::
checksum tree key (CSUM_TREE ROOT_ITEM 0) 29376512 level 0

# btrfs-corrupt-block -l 29376512 /dev/sdd
mirror 1 logical 29376512 physical 37765120 device /dev/sdd
corrupting 29376512 copy 1
mirror 2 logical 29376512 physical 145113088 device /dev/sdd
corrupting 29376512 copy 2
# btrfsck /dev/sdd
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
read block failed check_tree_block
Couldn't setup csum tree
checking extents
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
read block failed check_tree_block  <---- !!
Segmentation fault (core dumped)  <--- !!
#
----------------

read_tree_block frees buf and returns NULL
----------------
struct extent_buffer *read_tree_block(struct btrfs_root *root, u64 bytenr,
u32 blocksize, u64 parent_transid)
{
::

        while (1) {
::
                if (ignore) {
                        if (check_tree_block(root, eb))
                                printk("read block failed check_tree_block\n"); <----
                        else
                                printk("Csum didn't match\n");
                        break;
                }
::
        }
        free_extent_buffer(eb);
        return NULL;
}

----------------

we don't check if the buf is NULL and fails with Segmentation faults in add_root_to_pending
---------------------
static int check_extents(struct btrfs_trans_handle *trans,
struct btrfs_root *root, int repair)
{

::

                        buf = read_tree_block(root->fs_info->tree_root,
                                              btrfs_root_bytenr(&ri),
                                              btrfs_level_size(root,
                                               btrfs_root_level(&ri)), 0);   <--- buf is NULL

                        add_root_to_pending(buf, bits, bits_nr, &extent_cache,
                                            &pending, &seen, &reada, &nodes,
                                            &found_key);

                        free_extent_buffer(buf);
                }

-----------------------

Seems like the simple fix is to redirect btrfsck user to use --init-csum-tree when csum root is corrupted

thanks
Anand

From: Anand Jain <[email protected]>

Segmentation fault with the following trace when csum-tree is deliberately corrupted using btrfs-corrupt-block

read block failed check_tree_block
Couldn't setup csum tree
checking extents
Check tree block failed, want=29376512, have=0
::
read block failed check_tree_block <---- !!
Segmentation fault (core dumped) <--- !!

The below fix will redirect btrfsck user to use --init-csum-tree when csum root is corrupted

---
 btrfsck.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

index 7aac736..6ced7b5 100644
@@ -3483,6 +3483,10 @@ int main(int ac, char **av)
 		fprintf(stderr, "Critical roots corrupted, unable to fsck the FS\n");
 		return -EIO;
 	}
+	if (!extent_buffer_uptodate(info->csum_root->node) && !init_csum_tree) {
+		fprintf(stderr, "Checksum root corrupted, run 'btrfsck --init-csum-tree'\n");
+		return -EIO;
+	}
 
 	root = info->fs_root;
 

1.7.1