Re: [PATCH v2] Btrfs: detect corruption when non-root leaf has zero item
Hi,
On Fri, Sep 02, 2016 at 01:26:10AM -0400, Jeff Mahoney wrote:
> On 8/23/16 6:22 PM, Liu Bo wrote:
> > Right now we treat leaf which has zero item as a valid one
> > because we could have an empty tree, that is, a root that is
> > also a leaf without any item, however, in the same case but
> > when the leaf is not a root, we can end up with hitting the
> > BUG_ON(1) in btrfs_extend_item() called by
> > setup_inline_extent_backref().
> >
> > This makes us check the situation as a corruption if leaf is
> > not its own root.
> >
> > Signed-off-by: Liu Bo
> > ---
> > v2: fix code style.
> >
> > fs/btrfs/disk-io.c | 23 ++-
> > 1 file changed, 22 insertions(+), 1 deletion(-)
> >
> > diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
> > index a5a22be..8df7e73 100644
> > --- a/fs/btrfs/disk-io.c
> > +++ b/fs/btrfs/disk-io.c
> > @@ -559,8 +559,29 @@ static noinline int check_leaf(struct btrfs_root *root,
> > u32 nritems = btrfs_header_nritems(leaf);
> > int slot;
> >
> > - if (nritems == 0)
> > + if (nritems == 0) {
> > + struct btrfs_root *check_root;
> > +
> > + key.objectid = btrfs_header_owner(leaf);
> > + key.type = BTRFS_ROOT_ITEM_KEY;
> > + key.offset = (u64)-1;
> > +
> > + check_root = btrfs_get_fs_root(root->fs_info, &key, false);
> > + /*
> > +* The only reason we also check NULL here is that during
> > +* open_ctree() some roots has not yet been set up.
> > +*/
> > + if (!IS_ERR_OR_NULL(check_root)) {
> > + /* if leaf is the root, then it's fine */
> > + if (leaf->start !=
> > + btrfs_root_bytenr(&check_root->root_item)) {
> > + CORRUPT("non-root leaf's nritems is 0",
> > + leaf, root, 0);
> > + return -EIO;
> > + }
> > + }
> > return 0;
> > + }
> >
> > /* Check the 0 item */
> > if (btrfs_item_offset_nr(leaf, 0) + btrfs_item_size_nr(leaf, 0) !=
> >
>
> Hi Liu -
>
> This is causing probs with integrity checking turned on.
Thanks a lot for the report, just sent a fix, with which it doesn't panic any
more here.
Luckily it doesn't panic without integrity checking, otherwise we kind of
screw up every btrfs.
Thanks,
-liubo
>
> [ 124.716069] [ cut here ]
> [ 124.725914] kernel BUG at fs/btrfs/ctree.h:3396!
> [ 124.739316] invalid opcode: [#1] PREEMPT SMP
> [ 124.746888] Modules linked in: rpcsec_gss_krb5 nfsv4 dns_resolver nfs
> fscache iscsi_ibft iscsi_boot_sysfs af_packet ipmi_ssif igb ptp pps_core dca
> sp5100_tco fjes acpi_cpufreq shpchp i2c_piix4 kvm_amd kvm k10temp
> tpm_infineon tpm_tis tpm_tis_core ipmi_si button pcspkr serio_raw
> ipmi_msghandler tpm irqbypass nfsd auth_rpcgss nfs_acl lockd grace sunrpc
> dm_mod btrfs xor zlib_deflate ohci_pci raid6_pq ohci_hcd ehci_pci ata_generic
> ehci_hcd mgag200 i2c_algo_bit drm_kms_helper usbcore syscopyarea pata_atiixp
> sysfillrect sysimgblt usb_common fb_sys_fops ttm drm sg
> [ 124.815657] CPU: 9 PID: 2972 Comm: mount Not tainted 4.8.0-rc4-vanilla+ #18
> [ 124.826173] Hardware name: HP ProLiant DL165 G7, BIOS O37 10/17/2012
> [ 124.836043] task: 88033b450200 task.stack: 880337a7
> [ 124.845445] RIP: 0010:[] []
> assfail.constprop.60+0x1e/0x20 [btrfs]
> [ 124.858936] RSP: 0018:880337a73570 EFLAGS: 00010292
> [ 124.867793] RAX: 0076 RBX: 8804376ef250 RCX:
> 81c52f08
> [ 124.878735] RDX: 0001 RSI: 0286 RDI:
> 0286
> [ 124.889661] RBP: 880337a73570 R08: 041a R09:
>
> [ 124.900597] R10: 0003 R11: 0006 R12:
> 880337f97800
> [ 124.911563] R13: 0007 R14: R15:
> 880435024000
> [ 124.922522] FS: 7fa4662c1840() GS:88043fc4()
> knlGS:
> [ 124.934581] CS: 0010 DS: ES: CR0: 80050033
> [ 124.944015] CR2: 7ff68dcd2095 CR3: 00033ae32000 CR4:
> 06e0
> [ 124.955036] Stack:
> [ 124.960294] 880337a73598 a038fb04 8804376ef250
> 88043b45ebd0
> [ 124.971723] 88042c6225a0 880337a73618 a036a5f1
>
> [ 124.983186] 8801 880337a736d8
> 88043b45ebd0
> [ 124.994675] Call Trace:
> [ 125.000638] [] btrfs_mark_buffer_dirty+0xf4/0x120
> [btrfs]
> [ 125.011816] [] __btrfs_cow_block+0x311/0x5a0 [btrfs]
> [ 125.022524] [] btrfs_cow_block+0x136/0x210 [btrfs]
> [ 125.033025] [] btrfs_search_slot+0x1ea/0x960 [btrfs]
> [ 125.043731] [] btrfs_del_csums+0xd6/0x2b0 [btrfs]
> [ 125.054169] [] ? free_extent_buffer+0x4b/0x90 [btrfs]
> [ 125.064999] [] __btrfs_free_extent.isra.72+0x675/0xc60
> [btrfs]
> [ 125.076739] []
> __btrfs_run_d
Re: [PATCH v2] Btrfs: detect corruption when non-root leaf has zero item
On 8/23/16 6:22 PM, Liu Bo wrote:
> Right now we treat leaf which has zero item as a valid one
> because we could have an empty tree, that is, a root that is
> also a leaf without any item, however, in the same case but
> when the leaf is not a root, we can end up with hitting the
> BUG_ON(1) in btrfs_extend_item() called by
> setup_inline_extent_backref().
>
> This makes us check the situation as a corruption if leaf is
> not its own root.
>
> Signed-off-by: Liu Bo
> ---
> v2: fix code style.
>
> fs/btrfs/disk-io.c | 23 ++-
> 1 file changed, 22 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
> index a5a22be..8df7e73 100644
> --- a/fs/btrfs/disk-io.c
> +++ b/fs/btrfs/disk-io.c
> @@ -559,8 +559,29 @@ static noinline int check_leaf(struct btrfs_root *root,
> u32 nritems = btrfs_header_nritems(leaf);
> int slot;
>
> - if (nritems == 0)
> + if (nritems == 0) {
> + struct btrfs_root *check_root;
> +
> + key.objectid = btrfs_header_owner(leaf);
> + key.type = BTRFS_ROOT_ITEM_KEY;
> + key.offset = (u64)-1;
> +
> + check_root = btrfs_get_fs_root(root->fs_info, &key, false);
> + /*
> + * The only reason we also check NULL here is that during
> + * open_ctree() some roots has not yet been set up.
> + */
> + if (!IS_ERR_OR_NULL(check_root)) {
> + /* if leaf is the root, then it's fine */
> + if (leaf->start !=
> + btrfs_root_bytenr(&check_root->root_item)) {
> + CORRUPT("non-root leaf's nritems is 0",
> + leaf, root, 0);
> + return -EIO;
> + }
> + }
> return 0;
> + }
>
> /* Check the 0 item */
> if (btrfs_item_offset_nr(leaf, 0) + btrfs_item_size_nr(leaf, 0) !=
>
Hi Liu -
This is causing probs with integrity checking turned on.
[ 124.716069] [ cut here ]
[ 124.725914] kernel BUG at fs/btrfs/ctree.h:3396!
[ 124.739316] invalid opcode: [#1] PREEMPT SMP
[ 124.746888] Modules linked in: rpcsec_gss_krb5 nfsv4 dns_resolver nfs
fscache iscsi_ibft iscsi_boot_sysfs af_packet ipmi_ssif igb ptp pps_core dca
sp5100_tco fjes acpi_cpufreq shpchp i2c_piix4 kvm_amd kvm k10temp tpm_infineon
tpm_tis tpm_tis_core ipmi_si button pcspkr serio_raw ipmi_msghandler tpm
irqbypass nfsd auth_rpcgss nfs_acl lockd grace sunrpc dm_mod btrfs xor
zlib_deflate ohci_pci raid6_pq ohci_hcd ehci_pci ata_generic ehci_hcd mgag200
i2c_algo_bit drm_kms_helper usbcore syscopyarea pata_atiixp sysfillrect
sysimgblt usb_common fb_sys_fops ttm drm sg
[ 124.815657] CPU: 9 PID: 2972 Comm: mount Not tainted 4.8.0-rc4-vanilla+ #18
[ 124.826173] Hardware name: HP ProLiant DL165 G7, BIOS O37 10/17/2012
[ 124.836043] task: 88033b450200 task.stack: 880337a7
[ 124.845445] RIP: 0010:[] []
assfail.constprop.60+0x1e/0x20 [btrfs]
[ 124.858936] RSP: 0018:880337a73570 EFLAGS: 00010292
[ 124.867793] RAX: 0076 RBX: 8804376ef250 RCX: 81c52f08
[ 124.878735] RDX: 0001 RSI: 0286 RDI: 0286
[ 124.889661] RBP: 880337a73570 R08: 041a R09:
[ 124.900597] R10: 0003 R11: 0006 R12: 880337f97800
[ 124.911563] R13: 0007 R14: R15: 880435024000
[ 124.922522] FS: 7fa4662c1840() GS:88043fc4()
knlGS:
[ 124.934581] CS: 0010 DS: ES: CR0: 80050033
[ 124.944015] CR2: 7ff68dcd2095 CR3: 00033ae32000 CR4: 06e0
[ 124.955036] Stack:
[ 124.960294] 880337a73598 a038fb04 8804376ef250
88043b45ebd0
[ 124.971723] 88042c6225a0 880337a73618 a036a5f1
[ 124.983186] 8801 880337a736d8
88043b45ebd0
[ 124.994675] Call Trace:
[ 125.000638] [] btrfs_mark_buffer_dirty+0xf4/0x120 [btrfs]
[ 125.011816] [] __btrfs_cow_block+0x311/0x5a0 [btrfs]
[ 125.022524] [] btrfs_cow_block+0x136/0x210 [btrfs]
[ 125.033025] [] btrfs_search_slot+0x1ea/0x960 [btrfs]
[ 125.043731] [] btrfs_del_csums+0xd6/0x2b0 [btrfs]
[ 125.054169] [] ? free_extent_buffer+0x4b/0x90 [btrfs]
[ 125.064999] [] __btrfs_free_extent.isra.72+0x675/0xc60
[btrfs]
[ 125.076739] []
__btrfs_run_delayed_refs.constprop.81+0x467/0x12b0 [btrfs]
[ 125.089591] [] ? btrfs_get_token_32+0x59/0xe0 [btrfs]
[ 125.100486] [] btrfs_run_delayed_refs+0x93/0x2a0 [btrfs]
[ 125.111676] [] btrfs_start_dirty_block_groups+0x299/0x410
[btrfs]
[ 125.123752] [] btrfs_commit_transaction+0x155/0xae0
[btrfs]
[ 125.135289] [] btrfs_create_uuid_tree+0x59/0x130 [btrfs]
[ 125.146532] [] open_ctree+0x266d/0x2860 [btrfs]
[ 125.156916] [] btrfs_mount+0x
Re: [PATCH v2] Btrfs: detect corruption when non-root leaf has zero item
On Tue, Aug 23, 2016 at 03:22:58PM -0700, Liu Bo wrote: > Right now we treat leaf which has zero item as a valid one > because we could have an empty tree, that is, a root that is > also a leaf without any item, however, in the same case but > when the leaf is not a root, we can end up with hitting the > BUG_ON(1) in btrfs_extend_item() called by > setup_inline_extent_backref(). > > This makes us check the situation as a corruption if leaf is > not its own root. > > Signed-off-by: Liu Bo Reviewed-by: David Sterba -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH v2] Btrfs: detect corruption when non-root leaf has zero item
Right now we treat leaf which has zero item as a valid one
because we could have an empty tree, that is, a root that is
also a leaf without any item, however, in the same case but
when the leaf is not a root, we can end up with hitting the
BUG_ON(1) in btrfs_extend_item() called by
setup_inline_extent_backref().
This makes us check the situation as a corruption if leaf is
not its own root.
Signed-off-by: Liu Bo
---
v2: fix code style.
fs/btrfs/disk-io.c | 23 ++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index a5a22be..8df7e73 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -559,8 +559,29 @@ static noinline int check_leaf(struct btrfs_root *root,
u32 nritems = btrfs_header_nritems(leaf);
int slot;
- if (nritems == 0)
+ if (nritems == 0) {
+ struct btrfs_root *check_root;
+
+ key.objectid = btrfs_header_owner(leaf);
+ key.type = BTRFS_ROOT_ITEM_KEY;
+ key.offset = (u64)-1;
+
+ check_root = btrfs_get_fs_root(root->fs_info, &key, false);
+ /*
+* The only reason we also check NULL here is that during
+* open_ctree() some roots has not yet been set up.
+*/
+ if (!IS_ERR_OR_NULL(check_root)) {
+ /* if leaf is the root, then it's fine */
+ if (leaf->start !=
+ btrfs_root_bytenr(&check_root->root_item)) {
+ CORRUPT("non-root leaf's nritems is 0",
+ leaf, root, 0);
+ return -EIO;
+ }
+ }
return 0;
+ }
/* Check the 0 item */
if (btrfs_item_offset_nr(leaf, 0) + btrfs_item_size_nr(leaf, 0) !=
--
2.5.5
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
