queue-5.15/btrfs-export-handle-invalid-inode-or-root-reference-.patch

   1 From b76765d691a79ce752f1ce2c6a2178ce44f18bb0 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Fri, 19 Jan 2024 21:19:18 +0100
   4 Subject: btrfs: export: handle invalid inode or root reference in
   5  btrfs_get_parent()
   6
   7 From: David Sterba <dsterba@suse.com>
   8
   9 [ Upstream commit 26b66d1d366a375745755ca7365f67110bbf6bd5 ]
  10
  11 The get_parent handler looks up a parent of a given dentry, this can be
  12 either a subvolume or a directory. The search is set up with offset -1
  13 but it's never expected to find such item, as it would break allowed
  14 range of inode number or a root id. This means it's a corruption (ext4
  15 also returns this error code).
  16
  17 Reviewed-by: Josef Bacik <josef@toxicpanda.com>
  18 Reviewed-by: Anand Jain <anand.jain@oracle.com>
  19 Signed-off-by: David Sterba <dsterba@suse.com>
  20 Signed-off-by: Sasha Levin <sashal@kernel.org>
  21 ---
  22  fs/btrfs/export.c | 9 ++++++++-
  23  1 file changed, 8 insertions(+), 1 deletion(-)
  24
  25 diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
  26 index fab7eb76e53b2..58b0f04d7123f 100644
  27 --- a/fs/btrfs/export.c
  28 +++ b/fs/btrfs/export.c
  29 @@ -161,8 +161,15 @@ struct dentry *btrfs_get_parent(struct dentry *child)
  30         ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
  31         if (ret < 0)
  32                 goto fail;
  33 +       if (ret == 0) {
  34 +               /*
  35 +                * Key with offset of -1 found, there would have to exist an
  36 +                * inode with such number or a root with such id.
  37 +                */
  38 +               ret = -EUCLEAN;
  39 +               goto fail;
  40 +       }
  41
  42 -       BUG_ON(ret == 0); /* Key with offset of -1 found */
  43         if (path->slots[0] == 0) {
  44                 ret = -ENOENT;
  45                 goto fail;
  46 --
  47 2.43.0
  48