queue-6.8/btrfs-send-handle-path-ref-underflow-in-header-itera.patch

   1 From 86d194c9ed026f0293956eff0b01cd9357577f07 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Tue, 6 Feb 2024 22:47:13 +0100
   4 Subject: btrfs: send: handle path ref underflow in header iterate_inode_ref()
   5
   6 From: David Sterba <dsterba@suse.com>
   7
   8 [ Upstream commit 3c6ee34c6f9cd12802326da26631232a61743501 ]
   9
  10 Change BUG_ON to proper error handling if building the path buffer
  11 fails. The pointers are not printed so we don't accidentally leak kernel
  12 addresses.
  13
  14 Signed-off-by: David Sterba <dsterba@suse.com>
  15 Signed-off-by: Sasha Levin <sashal@kernel.org>
  16 ---
  17  fs/btrfs/send.c | 10 +++++++++-
  18  1 file changed, 9 insertions(+), 1 deletion(-)
  19
  20 diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
  21 index e9516509b2761..e8187669153dd 100644
  22 --- a/fs/btrfs/send.c
  23 +++ b/fs/btrfs/send.c
  24 @@ -1070,7 +1070,15 @@ static int iterate_inode_ref(struct btrfs_root *root, struct btrfs_path *path,
  25                                         ret = PTR_ERR(start);
  26                                         goto out;
  27                                 }
  28 -                               BUG_ON(start < p->buf);
  29 +                               if (unlikely(start < p->buf)) {
  30 +                                       btrfs_err(root->fs_info,
  31 +                       "send: path ref buffer underflow for key (%llu %u %llu)",
  32 +                                                 found_key->objectid,
  33 +                                                 found_key->type,
  34 +                                                 found_key->offset);
  35 +                                       ret = -EINVAL;
  36 +                                       goto out;
  37 +                               }
  38                         }
  39                         p->start = start;
  40                 } else {
  41 --
  42 2.43.0
  43