diff options
author | David Sterba <dsterba@suse.com> | 2024-01-23 23:42:29 +0100 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-04-13 12:50:15 +0200 |
commit | bebd9e0ff90034875c5dfe4bd514fd7055fc7a89 (patch) | |
tree | 506827349c826f6bb5898e4a02423150276f51eb | |
parent | c4f135f454deb2ff4b7a5ec53577aaa776e2fac9 (diff) | |
download | linux-stable-bebd9e0ff90034875c5dfe4bd514fd7055fc7a89.tar.gz linux-stable-bebd9e0ff90034875c5dfe4bd514fd7055fc7a89.tar.bz2 linux-stable-bebd9e0ff90034875c5dfe4bd514fd7055fc7a89.zip |
btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
[ Upstream commit 7411055db5ce64f836aaffd422396af0075fdc99 ]
The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption,
as it could be caused only by two impossible conditions:
- at first the search key is set up to look for a chunk tree item, with
offset -1, this is an inexact search and the key->offset will contain
the correct offset upon a successful search, a valid chunk tree item
cannot have an offset -1
- after first successful search, the found_key corresponds to a chunk
item, the offset is decremented by 1 before the next loop, it's
impossible to find a chunk item there due to alignment and size
constraints
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
-rw-r--r-- | fs/btrfs/volumes.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index ceced5e56c5a..30b5646b2c0d 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -2948,7 +2948,17 @@ again: mutex_unlock(&fs_info->delete_unused_bgs_mutex); goto error; } - BUG_ON(ret == 0); /* Corruption */ + if (ret == 0) { + /* + * On the first search we would find chunk tree with + * offset -1, which is not possible. On subsequent + * loops this would find an existing item on an invalid + * offset (one less than the previous one, wrong + * alignment and size). + */ + ret = -EUCLEAN; + goto error; + } ret = btrfs_previous_item(chunk_root, path, key.objectid, key.type); |