Skip to content

Commit bc4c173

Browse files
adam900710kdave
authored andcommitted
btrfs-progs: check/original: Do extra verification on file extent item
[BUG] For certain fuzzed image, `btrfs check` will fail with the following call trace: Checking filesystem on issue_213.raw UUID: 99e50868-0bda-4d89-b0e4-7e8560312ef9 [1/7] checking root items [2/7] checking extents Program received signal SIGABRT, Aborted. 0x00007ffff7c88f25 in raise () from /usr/lib/libc.so.6 (gdb) bt #0 0x00007ffff7c88f25 in raise () from /usr/lib/libc.so.6 #1 0x00007ffff7c72897 in abort () from /usr/lib/libc.so.6 #2 0x00005555555abc3e in run_next_block (...) at check/main.c:6398 #3 0x00005555555b0f36 in deal_root_from_list (...) at check/main.c:8408 #4 0x00005555555b1a3d in check_chunks_and_extents (fs_info=0x5555556a1e30) at check/main.c:8690 #5 0x00005555555b1e3e in do_check_chunks_and_extents (fs_info=0x5555556a1e30) a #6 0x00005555555b5710 in cmd_check (cmd=0x555555696920 <cmd_struct_check>, argc #7 0x0000555555568dc7 in cmd_execute (cmd=0x555555696920 <cmd_struct_check>, ar #8 0x0000555555569713 in main (argc=2, argv=0x7fffffffde70) at btrfs.c:386 [CAUSE] This fuzzed images has a corrupted EXTENT_DATA item in data reloc tree: item 1 key (256 EXTENT_DATA 256) itemoff 16111 itemsize 12 generation 0 type 2 (prealloc) prealloc data disk byte 16777216 nr 0 prealloc data offset 0 nr 0 There are several problems with the item: - Bad item size 12 is too small. - Bad key offset offset of EXTENT_DATA type key represents file offset, which should always be aligned to sector size (4K in this particular case). [FIX] Do extra item size and key offset check for original mode, and remove the abort() call in run_next_block(). And to show off how robust lowmem mode is, lowmem can handle it without any hiccup. With this fix, original mode can detect the problem properly: Checking filesystem on issue_213.raw UUID: 99e50868-0bda-4d89-b0e4-7e8560312ef9 [1/7] checking root items [2/7] checking extents ERROR: invalid file extent item size, have 12 expect (21, 16283] ERROR: errors found in extent allocation tree or chunk allocation [3/7] checking free space cache [4/7] checking fs roots root 18446744073709551607 root dir 256 error root 18446744073709551607 inode 256 errors 62, no orphan item, odd file extent, bad file extent ERROR: errors found in fs roots found 131072 bytes used, error(s) found total csum bytes: 0 total tree bytes: 131072 total fs tree bytes: 32768 total extent tree bytes: 16384 btree space waste bytes: 124774 file data blocks allocated: 0 referenced 0 Issue: #213 Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: Su Yue <Damenly_Su@gmx.com> Signed-off-by: David Sterba <dsterba@suse.com>
1 parent e395e8d commit bc4c173

File tree

1 file changed

+32
-2
lines changed

1 file changed

+32
-2
lines changed

check/main.c

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6268,7 +6268,10 @@ static int run_next_block(struct btrfs_root *root,
62686268
btree_space_waste += btrfs_leaf_free_space(buf);
62696269
for (i = 0; i < nritems; i++) {
62706270
struct btrfs_file_extent_item *fi;
6271+
unsigned long inline_offset;
62716272

6273+
inline_offset = offsetof(struct btrfs_file_extent_item,
6274+
disk_bytenr);
62726275
btrfs_item_key_to_cpu(buf, &key, i);
62736276
/*
62746277
* Check key type against the leaf owner.
@@ -6384,18 +6387,45 @@ static int run_next_block(struct btrfs_root *root,
63846387
}
63856388
if (key.type != BTRFS_EXTENT_DATA_KEY)
63866389
continue;
6390+
/* Check itemsize before we continue */
6391+
if (btrfs_item_size_nr(buf, i) < inline_offset) {
6392+
ret = -EUCLEAN;
6393+
error(
6394+
"invalid file extent item size, have %u expect (%lu, %lu]",
6395+
btrfs_item_size_nr(buf, i),
6396+
inline_offset,
6397+
BTRFS_LEAF_DATA_SIZE(fs_info));
6398+
continue;
6399+
}
63876400
fi = btrfs_item_ptr(buf, i,
63886401
struct btrfs_file_extent_item);
63896402
if (btrfs_file_extent_type(buf, fi) ==
63906403
BTRFS_FILE_EXTENT_INLINE)
63916404
continue;
6405+
6406+
/* Prealloc/regular extent must have fixed item size */
6407+
if (btrfs_item_size_nr(buf, i) !=
6408+
sizeof(struct btrfs_file_extent_item)) {
6409+
ret = -EUCLEAN;
6410+
error(
6411+
"invalid file extent item size, have %u expect %zu",
6412+
btrfs_item_size_nr(buf, i),
6413+
sizeof(struct btrfs_file_extent_item));
6414+
continue;
6415+
}
6416+
/* key.offset (file offset) must be aligned */
6417+
if (!IS_ALIGNED(key.offset, fs_info->sectorsize)) {
6418+
ret = -EUCLEAN;
6419+
error(
6420+
"invalid file offset, have %llu expect aligned to %u",
6421+
key.offset, fs_info->sectorsize);
6422+
continue;
6423+
}
63926424
if (btrfs_file_extent_disk_bytenr(buf, fi) == 0)
63936425
continue;
63946426

63956427
data_bytes_allocated +=
63966428
btrfs_file_extent_disk_num_bytes(buf, fi);
6397-
if (data_bytes_allocated < root->fs_info->sectorsize)
6398-
abort();
63996429

64006430
data_bytes_referenced +=
64016431
btrfs_file_extent_num_bytes(buf, fi);

0 commit comments

Comments
 (0)