Commit 147a097c authored Dec 09, 2019 by Qu Wenruo Committed by David Sterba Jan 20, 2020

btrfs: tree-checker: Verify location key for DIR_ITEM/DIR_INDEX



[PROBLEM]
There is a user report in the mail list, showing the following corrupted
tree blocks:

       item 62 key (486836 DIR_ITEM 2543451757) itemoff 6273 itemsize 74
               location key (4065004 INODE_ITEM 1073741824) type FILE
               transid 21397 data_len 0 name_len 44
               name: FILENAME

Note that location key, its offset should be 0 for all INODE_ITEMS.
This caused failed lookup of the inode.

[CAUSE]
That offending value, 1073741824, is 0x40000000. So this looks like a
memory bit flip.

[FIX]
This patch will enhance tree-checker to check location key of
DIR_INDEX/DIR_ITEM/XATTR_ITEM.

There are several different combinations needs to check:

- item_key.type == DIR_INDEX/DIR_ITEM

  * location_key.type == BTRFS_INODE_ITEM_KEY
    This location_key should follow the check in inode_item check.
  * location_key.type == BTRFS_ROOT_ITEM_KEY
    Despite the existing check, DIR_INDEX/DIR_ITEM can only points to
    subvolume trees.
  * All other keys are not allowed.

- item_key.type == XATTR_ITEM
  location_key should be all 0.

Reported-by: Mike Gilbert <floppymaster@gmail.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

parent 57a0e674

fs/btrfs/tree-checker.c

+21 −0

Original line number	Diff line number	Diff line
		@@ -484,12 +484,14 @@ static int check_dir_item(struct extent_buffer *leaf,
		return -EUCLEAN;
		di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item);
		while (cur < item_size) {
		struct btrfs_key location_key;
		u32 name_len;
		u32 data_len;
		u32 max_name_len;
		u32 total_size;
		u32 name_hash;
		u8 dir_type;
		int ret;

		/* header itself should not cross item boundary */
		if (cur + sizeof(*di) > item_size) {
		@@ -499,6 +501,25 @@ static int check_dir_item(struct extent_buffer *leaf,
		return -EUCLEAN;
		}

		/* Location key check */
		btrfs_dir_item_key_to_cpu(leaf, di, &location_key);
		if (location_key.type == BTRFS_ROOT_ITEM_KEY) {
		ret = check_root_key(leaf, &location_key, slot);
		if (ret < 0)
		return ret;
		} else if (location_key.type == BTRFS_INODE_ITEM_KEY \|\|
		location_key.type == 0) {
		ret = check_inode_key(leaf, &location_key, slot);
		if (ret < 0)
		return ret;
		} else {
		dir_item_err(leaf, slot,
		"invalid location key type, have %u, expect %u or %u",
		location_key.type, BTRFS_ROOT_ITEM_KEY,
		BTRFS_INODE_ITEM_KEY);
		return -EUCLEAN;
		}

		/* dir type check */
		dir_type = btrfs_dir_type(leaf, di);
		if (dir_type >= BTRFS_FT_MAX) {

Admin message