On Wed, Sep 14, 2016 at 05:22:57PM -0700, Liu Bo wrote:
> During updating btree, we could push items between sibling
> nodes/leaves, for leaves data sections starts reversely from
> the end of the block while for nodes we only have key pairs
> which are stored one by one from the start of the block.
>
> So we could do try to push key pairs from one node to the next
> node right in the tree, and after that, we update the node's
> nritems to reflect the correct end while leaving the stale
> content in the node. One may intentionally corrupt the fs
> image and access the stale content by bumping the nritems and
> causes various crashes.
>
> This takes the in-memory @nritems as the correct one and
> gets to memset the unused part of a btree node.
>
> Signed-off-by: Liu Bo <bo.li....@oracle.com>
Reviewed-by: David Sterba <dste...@suse.com>
> ---
> fs/btrfs/extent_io.c | 11 +++++++++++
> 1 file changed, 11 insertions(+)
>
> diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
> index c2325c3..56c9dee 100644
> --- a/fs/btrfs/extent_io.c
> +++ b/fs/btrfs/extent_io.c
> @@ -3732,6 +3732,17 @@ static noinline_for_stack int write_one_eb(struct
> extent_buffer *eb,
> if (btrfs_header_owner(eb) == BTRFS_TREE_LOG_OBJECTID)
> bio_flags = EXTENT_BIO_TREE_LOG;
>
> + /* set btree node beyond nritems with 0 to avoid stale content */
> + if (btrfs_header_level(eb) > 0) {
We can do the same for leaves.
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
