From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-co1nam03on0096.outbound.protection.outlook.com ([104.47.40.96]:44736 "EHLO NAM03-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727725AbeH3WMO (ORCPT ); Thu, 30 Aug 2018 18:12:14 -0400 From: Sasha Levin To: "stable@vger.kernel.org" CC: Qu Wenruo , David Sterba , Sasha Levin Subject: [PATCH AUTOSEL 4.18 104/113] btrfs: Exit gracefully when chunk map cannot be inserted to the tree Date: Thu, 30 Aug 2018 18:08:27 +0000 Message-ID: <20180830180714.36167-38-alexander.levin@microsoft.com> References: <20180830180714.36167-1-alexander.levin@microsoft.com> In-Reply-To: <20180830180714.36167-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Qu Wenruo [ Upstream commit 64f64f43c89aca1782aa672e0586f6903c5d8979 ] It's entirely possible that a crafted btrfs image contains overlapping chunks. Although we can't detect such problem by tree-checker, it's not a catastrophic problem, current extent map can already detect such problem and return -EEXIST. We just only need to exit gracefully and fail the mount. Reported-by: Xu Wen Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D200409 Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin --- fs/btrfs/volumes.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index 1da162928d1a..93765f17a454 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -6563,10 +6563,14 @@ static int read_one_chunk(struct btrfs_fs_info *fs_= info, struct btrfs_key *key, write_lock(&map_tree->map_tree.lock); ret =3D add_extent_mapping(&map_tree->map_tree, em, 0); write_unlock(&map_tree->map_tree.lock); - BUG_ON(ret); /* Tree corruption */ + if (ret < 0) { + btrfs_err(fs_info, + "failed to add chunk map, start=3D%llu len=3D%llu: %d", + em->start, em->len, ret); + } free_extent_map(em); =20 - return 0; + return ret; } =20 static void fill_device_from_item(struct extent_buffer *leaf, --=20 2.17.1