From: Nikolay Borisov <nborisov@suse.com>
To: Qu Wenruo <wqu@suse.com>, linux-btrfs@vger.kernel.org
Subject: Re: [PATCH v2 4/5] btrfs: extent-tree: Kill the BUG_ON() in insert_inline_extent_backref()
Date: Thu, 25 Jul 2019 13:20:13 +0300 [thread overview]
Message-ID: <59416b0c-f34a-3319-4eac-09cc703c78eb@suse.com> (raw)
In-Reply-To: <20190725061222.9581-5-wqu@suse.com>
On 25.07.19 г. 9:12 ч., Qu Wenruo wrote:
> [BUG]
> With crafted image, btrfs can panic at insert_inline_extent_backref():
> kernel BUG at fs/btrfs/extent-tree.c:1857!
> invalid opcode: 0000 [#1] SMP PTI
> CPU: 0 PID: 1117 Comm: btrfs-transacti Not tainted 5.0.0-rc8+ #9
> RIP: 0010:insert_inline_extent_backref+0xcc/0xe0
> Code: 45 20 49 8b 7e 50 49 89 d8 4c 8b 4d 10 48 8b 55 c8 4c 89 e1 41 57 4c 89 ee 50 ff 75 18 e8 cc bf ff ff 31 c0 48 83 c4 18 eb b2 <0f> 0b e8 9d df bd ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 66 66
> RSP: 0018:ffffac4dc1287be8 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 0000000000000007 RCX: 0000000000000001
> RDX: 0000000000001000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffffac4dc1287c28 R08: ffffac4dc1287ab8 R09: ffffac4dc1287ac0
> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> R13: ffff8febef88a540 R14: ffff8febeaa7bc30 R15: 0000000000000000
> FS: 0000000000000000(0000) GS:ffff8febf7a00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f663ace94c0 CR3: 0000000235698006 CR4: 00000000000206f0
> Call Trace:
> ? _cond_resched+0x1a/0x50
> __btrfs_inc_extent_ref.isra.64+0x7e/0x240
> ? btrfs_merge_delayed_refs+0xa5/0x330
> __btrfs_run_delayed_refs+0x653/0x1120
> btrfs_run_delayed_refs+0xdb/0x1b0
> btrfs_commit_transaction+0x52/0x950
> ? start_transaction+0x94/0x450
> transaction_kthread+0x163/0x190
> kthread+0x105/0x140
> ? btrfs_cleanup_transaction+0x560/0x560
> ? kthread_destroy_worker+0x50/0x50
> ret_from_fork+0x35/0x40
> Modules linked in:
> ---[ end trace 2ad8b3de903cf825 ]---
>
> [CAUSE]
> Due to extent tree corruption (still valid by itself, but bad cross ref),
> we can allocate an extent which is still in extent tree.
> The offending tree block of that case is from csum tree.
> The newly allocated tree block is also for csum tree.
>
> Then we will try to insert an tree block ref for the existing tree block
> ref.
>
> For btrfs tree extent item, a tree block can never be shared directly by
> the same tree twice.
> We have such BUG_ON() to prevent such problem, but BUG_ON() is
> definitely not good enough.
>
> [FIX]
> Replace that BUG_ON() with proper error message and leaf dump for debug
> build.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=202829
> Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
> ---
> fs/btrfs/extent-tree.c | 20 +++++++++++++++++++-
> 1 file changed, 19 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
> index 74e4b138218e..19dd9148a3aa 100644
> --- a/fs/btrfs/extent-tree.c
> +++ b/fs/btrfs/extent-tree.c
> @@ -1856,7 +1856,22 @@ int insert_inline_extent_backref(struct btrfs_trans_handle *trans,
> num_bytes, parent, root_objectid,
> owner, offset, 1);
> if (ret == 0) {
> - BUG_ON(owner < BTRFS_FIRST_FREE_OBJECTID);
> + /*
> + * We're adding refs to an tree block we already own, this
> + * should not happen at all.
> + */
> + if (owner < BTRFS_FIRST_FREE_OBJECTID) {
> + btrfs_crit(trans->fs_info,
> +"invalid operation, adding refs to an existing tree ref, bytenr=%llu num_bytes=%llu root_objectid=%llu",
> + bytenr, num_bytes, root_objectid);
> + if (IS_ENABLED(CONFIG_BTRFS_DEBUG)) {
> + WARN_ON(1);
> + btrfs_crit(trans->fs_info,
> + "path->slots[0]=%d path->nodes[0]:", path->slots[0]);
> + btrfs_print_leaf(path->nodes[0]);
> + }
> + return -EUCLEAN;
> + }
> update_inline_extent_backref(path, iref, refs_to_add,
> extent_op, NULL);
> } else if (ret == -ENOENT) {
> @@ -2073,6 +2088,9 @@ int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
> /*
> * __btrfs_inc_extent_ref - insert backreference for a given extent
> *
> + * The work is opposite as __btrfs_free_extent().
> + * For more info about how it works or examples, refer to __btrfs_free_extent().
> + *
> * @trans: Handle of transaction
> *
> * @node: The delayed ref node used to get the bytenr/length for
>
next prev parent reply other threads:[~2019-07-25 10:20 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-25 6:12 [PATCH v2 0/5] btrfs: Enhanced runtime defence against fuzzed images Qu Wenruo
2019-07-25 6:12 ` [PATCH v2 1/5] btrfs: extent_io: Do extra check for extent buffer read write functions Qu Wenruo
2019-07-25 6:44 ` Nikolay Borisov
2019-07-25 6:58 ` Qu Wenruo
2019-07-31 13:47 ` David Sterba
2019-07-25 6:12 ` [PATCH v2 2/5] btrfs: extent-tree: Kill BUG_ON() in __btrfs_free_extent() and do better comment Qu Wenruo
2019-07-25 8:39 ` Nikolay Borisov
2019-07-25 9:31 ` Qu Wenruo
2019-07-30 14:59 ` kbuild test robot
2019-07-25 6:12 ` [PATCH v2 3/5] btrfs: Detect unbalanced tree with empty leaf before crashing btree operations Qu Wenruo
2019-07-25 9:26 ` Nikolay Borisov
2019-07-25 9:34 ` Qu Wenruo
2019-08-06 13:58 ` David Sterba
2019-08-06 14:04 ` Qu Wenruo
2019-08-06 17:47 ` David Sterba
2019-08-07 2:22 ` Qu Wenruo
2019-08-07 6:08 ` Qu Wenruo
2019-07-25 6:12 ` [PATCH v2 4/5] btrfs: extent-tree: Kill the BUG_ON() in insert_inline_extent_backref() Qu Wenruo
2019-07-25 10:20 ` Nikolay Borisov [this message]
2019-07-25 6:12 ` [PATCH v2 5/5] btrfs: ctree: Checking key orders before merged tree blocks Qu Wenruo
2019-07-25 6:49 ` [PATCH v2 0/5] btrfs: Enhanced runtime defence against fuzzed images Nikolay Borisov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=59416b0c-f34a-3319-4eac-09cc703c78eb@suse.com \
--to=nborisov@suse.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=wqu@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).