diff mbox

[4/5] btrfs-progs: check: check extent_inline_ref in lowmem

Message ID 20170927063440.25961-5-suy.fnst@cn.fujitsu.com (mailing list archive)
State New, archived
Headers show

Commit Message

Su Yue Sept. 27, 2017, 6:34 a.m. UTC 
Lowmem check does not skip invalid type in extent_inline_ref then
calls btrfs_extent_inline_ref_size(type) which causes crash.

Error:
$ btrfs check --mode=lowmem  /tmp/data_small
Checking filesystem on /tmp/data_small
UUID: ee205d69-8724-4aa2-a4f5-bc8558a62169
checking extents
ERROR: extent[20971520 16384] backref type mismatch, missing bit: 2
ERROR: extent[20971520 16384] backref generation mismatch,
wanted: 7, have: 0
ERROR: extent[20971520 16384] is referred by other roots than 3
ctree.h:1754: btrfs_extent_inline_ref_size: BUG_ON `1` triggered,
value 1
btrfs(+0x543db)[0x55fabc2ab3db]
btrfs(+0x587f7)[0x55fabc2af7f7]
btrfs(+0x5fa44)[0x55fabc2b6a44]
btrfs(cmd_check+0x194a)[0x55fabc2bd717]
btrfs(main+0x88)[0x55fabc2682e0]
/usr/lib/libc.so.6(__libc_start_main+0xea)[0x7f021c3824ca]
btrfs(_start+0x2a)[0x55fabc267e7a]
[1] 5188 abort (core dumped)  btrfs check --mode=lowmem /tmp/data_small

Solve it by introducing check_extent_inline_ref() to check type.
If the checker returns a nonzero value, we should not check the
corrupted extent item anymore.

Suggested-by: Qu Wenruo <quwenruo.btrfs@gmx.com>
Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com>
---
 cmds-check.c | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
diff mbox

Patch

diff --git a/cmds-check.c b/cmds-check.c
index adc4a934..aa054a19 100644
--- a/cmds-check.c
+++ b/cmds-check.c
@@ -11415,6 +11415,29 @@  loop:
 	goto again;
 }
 
+static int check_extent_inline_ref(struct extent_buffer *eb,
+		   struct btrfs_key *key, struct btrfs_extent_inline_ref *iref)
+{
+	int ret;
+	u8 type = btrfs_extent_inline_ref_type(eb, iref);
+
+	switch (type) {
+	case BTRFS_TREE_BLOCK_REF_KEY:
+	case BTRFS_EXTENT_DATA_REF_KEY:
+	case BTRFS_SHARED_BLOCK_REF_KEY:
+	case BTRFS_SHARED_DATA_REF_KEY:
+		ret = 0;
+		break;
+	default:
+		error("extent[%llu %u %llu] has unknown ref type: %d",
+		      key->objectid, key->type, key->offset, type);
+		ret = UNKNOWN_TYPE;
+		break;
+	}
+
+	return ret;
+}
+
 /*
  * Check backrefs of a tree block given by @bytenr or @eb.
  *
@@ -11549,6 +11572,11 @@  static int check_tree_block_ref(struct btrfs_root *root,
 		type = btrfs_extent_inline_ref_type(leaf, iref);
 		offset = btrfs_extent_inline_ref_offset(leaf, iref);
 
+		ret = check_extent_inline_ref(leaf, &key, iref);
+		if (ret) {
+			err |= ret;
+			break;
+		}
 		if (type == BTRFS_TREE_BLOCK_REF_KEY) {
 			if (offset == root->objectid)
 				found_ref = 1;
@@ -11826,6 +11854,11 @@  static int check_extent_data_item(struct btrfs_root *root,
 		type = btrfs_extent_inline_ref_type(leaf, iref);
 		dref = (struct btrfs_extent_data_ref *)(&iref->offset);
 
+		ret = check_extent_inline_ref(leaf, &dbref_key, iref);
+		if (ret) {
+			err |= ret;
+			break;
+		}
 		if (type == BTRFS_EXTENT_DATA_REF_KEY) {
 			ref_root = btrfs_extent_data_ref_root(leaf, dref);
 			if (ref_root == root->objectid)