From: Filipe Manana Date: Thu, 13 Nov 2025 16:44:41 +0000 (+0000) Subject: btrfs: abort transaction on item count overflow in __push_leaf_left() X-Git-Tag: v6.19-rc1~167^2~34 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5d8222a50ad37c98455da08b33ce49fe6b726c72;p=thirdparty%2Flinux.git btrfs: abort transaction on item count overflow in __push_leaf_left() If we try to push an item count from the right leaf that is greater than the number of items in the leaf, we just emit a warning. This should never happen but if it does we get an underflow in the new number of items in the right leaf and chaos follows from it. So replace the warning with proper error handling, by aborting the transaction and returning -EUCLEAN, and proper logging by using btrfs_crit() instead of WARN(), which gives us proper formatting and information about the filesystem. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba --- diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index 57b7d09d85cc2..8b54daf3d0e71 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -3393,9 +3393,13 @@ static noinline int __push_leaf_left(struct btrfs_trans_handle *trans, btrfs_set_header_nritems(left, old_left_nritems + push_items); /* fixup right node */ - if (push_items > right_nritems) - WARN(1, KERN_CRIT "push items %d nr %u\n", push_items, - right_nritems); + if (unlikely(push_items > right_nritems)) { + ret = -EUCLEAN; + btrfs_abort_transaction(trans, ret); + btrfs_crit(fs_info, "push items (%d) > right leaf items (%u)", + push_items, right_nritems); + goto out; + } if (push_items < right_nritems) { push_space = btrfs_item_offset(right, push_items - 1) -