Re: [PATCH 2/2] btrfs: tree-checker: check item_size for dev_item

[Wang Yugui <wangyugui@e16-tech.com>]

Hi,

> A btrfs filesystem failed to boot with this patch.
> 
> corrupt leaf: root=3 block=1081344 slot=0 devid=1 invalid item size: has 0 expect 98
> 
> Any way to fix it online?

This btrfs filesystem is created by centos 7.9 installer (btrfs 4.9?)
about 1 years ago.  and then mainly writen by kernel 5.4/5.10/5.15.

Best Regards
Wang Yugui (wangyugui@e16-tech.com)
2022/02/05


> 
> > Check item size before accessing the device item to avoid out of bound
> > access.
> > 
> > Signed-off-by: Su Yue <l@damenly.su>
> > ---
> >  fs/btrfs/tree-checker.c | 8 ++++++++
> >  1 file changed, 8 insertions(+)
> > 
> > diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
> > index 2978fc89c093..87fff4345977 100644
> > --- a/fs/btrfs/tree-checker.c
> > +++ b/fs/btrfs/tree-checker.c
> > @@ -965,6 +965,7 @@ static int check_dev_item(struct extent_buffer *leaf,
> >  			  struct btrfs_key *key, int slot)
> >  {
> >  	struct btrfs_dev_item *ditem;
> > +	u32 item_size = btrfs_item_size(leaf, slot);
> >  
> >  	if (unlikely(key->objectid != BTRFS_DEV_ITEMS_OBJECTID)) {
> >  		dev_item_err(leaf, slot,
> > @@ -972,6 +973,13 @@ static int check_dev_item(struct extent_buffer *leaf,
> >  			     key->objectid, BTRFS_DEV_ITEMS_OBJECTID);
> >  		return -EUCLEAN;
> >  	}
> > +
> > +	if (unlikely(item_size != sizeof(*ditem))) {
> > +		dev_item_err(leaf, slot, "invalid item size: has=%u expect=%zu",
> > +			     item_size, sizeof(*ditem));
> > +		return -EUCLEAN;
> > +	}
> > +
> >  	ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item);
> >  	if (unlikely(btrfs_device_id(leaf, ditem) != key->offset)) {
> >  		dev_item_err(leaf, slot,
> > -- 
> > 2.34.1
>