btrfs: ref-verify: handle damaged extent root tree
David Sterba
maintainerPATCH 1/1 btrfs: ref-verify: handle damaged extent root tree
Syzbot hits a problem with enabled ref-verify, ignorebadroots and a fuzzed/damaged extent tree. There's no fallback option like in other places that can deal with it so disable the whole ref-verify as it is just a debugging feature.
--- fs/btrfs/ref-verify.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/btrfs/ref-verify.c +8 -1
@@ -980,11 +980,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)if (!btrfs_test_opt (fs_info,REF_VERIFY ))return 0 ; + extent_root =btrfs_extent_root (fs_info,0 ); +/* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */ +if (IS_ERR (extent_root)) { +btrfs_warn (fs_info,"ref-verify: extent tree not available, disabling" ); +btrfs_clear_opt (fs_info->mount_opt,REF_VERIFY ); +return 0 ; + } + path =btrfs_alloc_path ();if (!path)return -ENOMEM ; - extent_root =btrfs_extent_root (fs_info,0 ); eb =btrfs_read_lock_root_node (extent_root); level =btrfs_header_level (eb); path->nodes[level] = eb;
Signature · 1 line
2.51.0
Quoted 6 lines · David Sterba
Syzbot hits a problem with enabled ref-verify, ignorebadroots and a fuzzed/damaged extent tree. There's no fallback option like in other places that can deal with it so disable the whole ref-verify as it is just a debugging feature.
Reported-by [email protected]
Maybe a Link: tag to the original report?
Quoted 1 line
Signed-off-by David Sterba <[email protected]>
Thanks,
Qu
Quoted 28 lines
--- fs/btrfs/ref-verify.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)fs/btrfs/ref-verify.c +8
-1@@ -980,11 +980,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)if (!btrfs_test_opt (fs_info,REF_VERIFY ))return 0 ; + extent_root =btrfs_extent_root (fs_info,0 ); +/* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */ +if (IS_ERR (extent_root)) { +btrfs_warn (fs_info,"ref-verify: extent tree not available, disabling" ); +btrfs_clear_opt (fs_info->mount_opt,REF_VERIFY ); +return 0 ; + } + path =btrfs_alloc_path ();if (!path)return -ENOMEM ; - extent_root =btrfs_extent_root (fs_info,0 ); eb =btrfs_read_lock_root_node (extent_root); level =btrfs_header_level (eb); path->nodes[level] = eb;
Quoted 16 lines · David Sterba
Syzbot hits a problem with enabled ref-verify, ignorebadroots and a fuzzed/damaged extent tree. There's no fallback option like in other places that can deal with it so disable the whole ref-verify as it is just a debugging feature.
Reported-by [email protected]Signed-off-by David Sterba <[email protected]>--- fs/btrfs/ref-verify.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)fs/btrfs/ref-verify.c +0
-0
fs/btrfs/ref-verify.c int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info) · line 989
Quoted 10 lines
fs/btrfs/ref-verify.c +7
-0@@ -980,11 +980,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)if (!btrfs_test_opt (fs_info,REF_VERIFY ))return 0 ; + extent_root =btrfs_extent_root (fs_info,0 ); +/* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */ +if (IS_ERR (extent_root)) { +btrfs_warn (fs_info,"ref-verify: extent tree not available, disabling" ); +btrfs_clear_opt (fs_info->mount_opt,REF_VERIFY ); +return 0 ; + }
I saw that someone tested a patch for this bug but it doesn't show the patch itself...
https://lore.kernel.org/all/[email protected]/
Smatch says that btrfs_extent_root() can't return error pointers. I would have expected an error pointer dereference to crash in btrfs_comp_cpu_keys(). The pointer in the bug report 0xdffffc0000000003 is not an error pointer. What am I missing?
regards,
dan carpenter