queue-5.15/btrfs-handle-chunk-tree-lookup-error-in-btrfs_reloca.patch

   1 From 70cbde54000a94e84a699d940989e1cd8f72bdb3 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Tue, 23 Jan 2024 23:42:29 +0100
   4 Subject: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
   5
   6 From: David Sterba <dsterba@suse.com>
   7
   8 [ Upstream commit 7411055db5ce64f836aaffd422396af0075fdc99 ]
   9
  10 The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption,
  11 as it could be caused only by two impossible conditions:
  12
  13 - at first the search key is set up to look for a chunk tree item, with
  14   offset -1, this is an inexact search and the key->offset will contain
  15   the correct offset upon a successful search, a valid chunk tree item
  16   cannot have an offset -1
  17
  18 - after first successful search, the found_key corresponds to a chunk
  19   item, the offset is decremented by 1 before the next loop, it's
  20   impossible to find a chunk item there due to alignment and size
  21   constraints
  22
  23 Reviewed-by: Josef Bacik <josef@toxicpanda.com>
  24 Reviewed-by: Anand Jain <anand.jain@oracle.com>
  25 Signed-off-by: David Sterba <dsterba@suse.com>
  26 Signed-off-by: Sasha Levin <sashal@kernel.org>
  27 ---
  28  fs/btrfs/volumes.c | 12 +++++++++++-
  29  1 file changed, 11 insertions(+), 1 deletion(-)
  30
  31 diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
  32 index 1ce0fa487e5b2..36e77956c63fa 100644
  33 --- a/fs/btrfs/volumes.c
  34 +++ b/fs/btrfs/volumes.c
  35 @@ -3358,7 +3358,17 @@ static int btrfs_relocate_sys_chunks(struct btrfs_fs_info *fs_info)
  36                         mutex_unlock(&fs_info->reclaim_bgs_lock);
  37                         goto error;
  38                 }
  39 -               BUG_ON(ret == 0); /* Corruption */
  40 +               if (ret == 0) {
  41 +                       /*
  42 +                        * On the first search we would find chunk tree with
  43 +                        * offset -1, which is not possible. On subsequent
  44 +                        * loops this would find an existing item on an invalid
  45 +                        * offset (one less than the previous one, wrong
  46 +                        * alignment and size).
  47 +                        */
  48 +                       ret = -EUCLEAN;
  49 +                       goto error;
  50 +               }
  51
  52                 ret = btrfs_previous_item(chunk_root, path, key.objectid,
  53                                           key.type);
  54 --
  55 2.43.0
  56