RepoMirrors
/
btrfs-progs
mirror of https://github.com/kdave/btrfs-progs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

btrfs-progs: ctree: Add extra level check for read_node_slot() 

Strangely, we have level check in btrfs_print_tree() while we don't have
the same check in read_node_slot().

That's to say, for the following corruption, btrfs_search_slot() or
btrfs_next_leaf() can return invalid leaf:

Parent eb:
  node XXXXXX level 1
              ^^^^^^^
              Child should be leaf (level 0)
  ...
  key (XXX XXX XXX) block YYYYYY

Child eb:
  leaf YYYYYY level 1
              ^^^^^^^
              Something went wrong now

And for the corrupted leaf returned, later caller can be screwed up
easily.

Reported-by: Ralph Gauges <ralphgauges@googlemail.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
Qu Wenruo 2018-02-08 08:59:40 +08:00 committed by David Sterba
parent e875cd98e3
commit 2615aca92c
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
ctree.c
View File

@ -22,6 +22,7 @@
#include "repair.h"
#include "internal.h"
#include "sizes.h"
#include "messages.h"
static int split_node(struct btrfs_trans_handle *trans, struct btrfs_root
*root, struct btrfs_path *path, int level);
@ -642,7 +643,9 @@ static int bin_search(struct extent_buffer *eb, struct btrfs_key *key,
struct extent_buffer *read_node_slot(struct btrfs_fs_info *fs_info,
struct extent_buffer *parent, int slot)
{
struct extent_buffer *ret;
int level = btrfs_header_level(parent);
if (slot < 0)
return NULL;
if (slot >= btrfs_header_nritems(parent))
@ -651,8 +654,20 @@ struct extent_buffer *read_node_slot(struct btrfs_fs_info *fs_info,
if (level == 0)
return NULL;
return read_tree_block(fs_info, btrfs_node_blockptr(parent, slot),
ret = read_tree_block(fs_info, btrfs_node_blockptr(parent, slot),
btrfs_node_ptr_generation(parent, slot));
if (!extent_buffer_uptodate(ret))
return ERR_PTR(-EIO);
if (btrfs_header_level(ret) != level - 1) {
error(
"child eb corrupted: parent bytenr=%llu item=%d parent level=%d child level=%d",
btrfs_header_bytenr(parent), slot,
btrfs_header_level(parent), btrfs_header_level(ret));
free_extent_buffer(ret);
return ERR_PTR(-EIO);
}
return ret;
}
static int balance_level(struct btrfs_trans_handle *trans,