* [PATCH] Btrfs: error out if generic_bin_search get invalid arguments
@ 2016-06-23 1:32 Liu Bo
2016-06-23 8:51 ` David Sterba
2016-06-23 23:32 ` [PATCH v2] " Liu Bo
0 siblings, 2 replies; 5+ messages in thread
From: Liu Bo @ 2016-06-23 1:32 UTC (permalink / raw)
To: linux-btrfs
With btrfs-corrupt-block, one can set btree node/leaf's field, if
we assign a negative value to node/leaf, we can get various hangs,
eg. if extent_root's nritems is -2ULL, then we get stuck in
btrfs_read_block_groups() because it has a while loop and
btrfs_search_slot() on extent_root will always return the first
child.
This lets us know what's happening and returns a EINVAL to callers
instead of returning the first item.
Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
fs/btrfs/ctree.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index c49a500..915d224 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1770,6 +1770,14 @@ static noinline int generic_bin_search(struct extent_buffer *eb,
unsigned long map_len = 0;
int err;
+ if (low > high) {
+ btrfs_err(eb->fs_info,
+ "%s: low (%d) < high (%d) eb %llu owner %llu level %d",
+ __func__, low, high, eb->start,
+ btrfs_header_owner(eb), btrfs_header_level(eb));
+ return -EINVAL;
+ }
+
while (low < high) {
mid = (low + high) / 2;
offset = p + mid * item_size;
--
2.5.5
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] Btrfs: error out if generic_bin_search get invalid arguments
2016-06-23 1:32 [PATCH] Btrfs: error out if generic_bin_search get invalid arguments Liu Bo
@ 2016-06-23 8:51 ` David Sterba
2016-06-23 17:38 ` Liu Bo
2016-06-23 23:32 ` [PATCH v2] " Liu Bo
1 sibling, 1 reply; 5+ messages in thread
From: David Sterba @ 2016-06-23 8:51 UTC (permalink / raw)
To: Liu Bo; +Cc: linux-btrfs
On Wed, Jun 22, 2016 at 06:32:19PM -0700, Liu Bo wrote:
> With btrfs-corrupt-block, one can set btree node/leaf's field, if
> we assign a negative value to node/leaf, we can get various hangs,
> eg. if extent_root's nritems is -2ULL, then we get stuck in
> btrfs_read_block_groups() because it has a while loop and
> btrfs_search_slot() on extent_root will always return the first
> child.
>
> This lets us know what's happening and returns a EINVAL to callers
> instead of returning the first item.
>
> Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> ---
> fs/btrfs/ctree.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
> index c49a500..915d224 100644
> --- a/fs/btrfs/ctree.c
> +++ b/fs/btrfs/ctree.c
> @@ -1770,6 +1770,14 @@ static noinline int generic_bin_search(struct extent_buffer *eb,
> unsigned long map_len = 0;
> int err;
>
> + if (low > high) {
> + btrfs_err(eb->fs_info,
> + "%s: low (%d) < high (%d) eb %llu owner %llu level %d",
Why is it '<' in the error message?
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Btrfs: error out if generic_bin_search get invalid arguments
2016-06-23 8:51 ` David Sterba
@ 2016-06-23 17:38 ` Liu Bo
0 siblings, 0 replies; 5+ messages in thread
From: Liu Bo @ 2016-06-23 17:38 UTC (permalink / raw)
To: dsterba, linux-btrfs
On Thu, Jun 23, 2016 at 10:51:52AM +0200, David Sterba wrote:
> On Wed, Jun 22, 2016 at 06:32:19PM -0700, Liu Bo wrote:
> > With btrfs-corrupt-block, one can set btree node/leaf's field, if
> > we assign a negative value to node/leaf, we can get various hangs,
> > eg. if extent_root's nritems is -2ULL, then we get stuck in
> > btrfs_read_block_groups() because it has a while loop and
> > btrfs_search_slot() on extent_root will always return the first
> > child.
> >
> > This lets us know what's happening and returns a EINVAL to callers
> > instead of returning the first item.
> >
> > Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> > ---
> > fs/btrfs/ctree.c | 8 ++++++++
> > 1 file changed, 8 insertions(+)
> >
> > diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
> > index c49a500..915d224 100644
> > --- a/fs/btrfs/ctree.c
> > +++ b/fs/btrfs/ctree.c
> > @@ -1770,6 +1770,14 @@ static noinline int generic_bin_search(struct extent_buffer *eb,
> > unsigned long map_len = 0;
> > int err;
> >
> > + if (low > high) {
> > + btrfs_err(eb->fs_info,
> > + "%s: low (%d) < high (%d) eb %llu owner %llu level %d",
>
> Why is it '<' in the error message?
Err, my typo error.
Thanks,
-liubo
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2] Btrfs: error out if generic_bin_search get invalid arguments
2016-06-23 1:32 [PATCH] Btrfs: error out if generic_bin_search get invalid arguments Liu Bo
2016-06-23 8:51 ` David Sterba
@ 2016-06-23 23:32 ` Liu Bo
2016-07-07 12:11 ` David Sterba
1 sibling, 1 reply; 5+ messages in thread
From: Liu Bo @ 2016-06-23 23:32 UTC (permalink / raw)
To: linux-btrfs; +Cc: dsterba
With btrfs-corrupt-block, one can set btree node/leaf's field, if
we assign a negative value to node/leaf, we can get various hangs,
eg. if extent_root's nritems is -2ULL, then we get stuck in
btrfs_read_block_groups() because it has a while loop and
btrfs_search_slot() on extent_root will always return the first
child.
This lets us know what's happening and returns a EINVAL to callers
instead of returning the first item.
Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
v2: fix typo of in printed message.
fs/btrfs/ctree.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index c49a500..915d224 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1770,6 +1770,14 @@ static noinline int generic_bin_search(struct extent_buffer *eb,
unsigned long map_len = 0;
int err;
+ if (low > high) {
+ btrfs_err(eb->fs_info,
+ "%s: low (%d) > high (%d) eb %llu owner %llu level %d",
+ __func__, low, high, eb->start,
+ btrfs_header_owner(eb), btrfs_header_level(eb));
+ return -EINVAL;
+ }
+
while (low < high) {
mid = (low + high) / 2;
offset = p + mid * item_size;
--
2.5.5
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2] Btrfs: error out if generic_bin_search get invalid arguments
2016-06-23 23:32 ` [PATCH v2] " Liu Bo
@ 2016-07-07 12:11 ` David Sterba
0 siblings, 0 replies; 5+ messages in thread
From: David Sterba @ 2016-07-07 12:11 UTC (permalink / raw)
To: Liu Bo; +Cc: linux-btrfs, dsterba
On Thu, Jun 23, 2016 at 04:32:45PM -0700, Liu Bo wrote:
> With btrfs-corrupt-block, one can set btree node/leaf's field, if
> we assign a negative value to node/leaf, we can get various hangs,
> eg. if extent_root's nritems is -2ULL, then we get stuck in
> btrfs_read_block_groups() because it has a while loop and
> btrfs_search_slot() on extent_root will always return the first
> child.
>
> This lets us know what's happening and returns a EINVAL to callers
> instead of returning the first item.
>
> Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-07-07 12:12 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-23 1:32 [PATCH] Btrfs: error out if generic_bin_search get invalid arguments Liu Bo
2016-06-23 8:51 ` David Sterba
2016-06-23 17:38 ` Liu Bo
2016-06-23 23:32 ` [PATCH v2] " Liu Bo
2016-07-07 12:11 ` David Sterba
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.