Re: [PATCH] btrfs: ref-verify: handle damaged extent root tree

[Dan Carpenter <dan.carpenter@linaro.org>]

On Mon, Sep 15, 2025 at 08:37:47AM +0200, David Sterba wrote:
> Syzbot hits a problem with enabled ref-verify, ignorebadroots and a
> fuzzed/damaged extent tree. There's no fallback option like in other
> places that can deal with it so disable the whole ref-verify as it is
> just a debugging feature.
> 
> Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com
> Signed-off-by: David Sterba <dsterba@suse.com>
> ---
>  fs/btrfs/ref-verify.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
> index 3871c3a6c743b5..9f1858b42c0e21 100644
> --- a/fs/btrfs/ref-verify.c
> +++ b/fs/btrfs/ref-verify.c
> @@ -980,11 +980,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)
>  	if (!btrfs_test_opt(fs_info, REF_VERIFY))
>  		return 0;
>  
> +	extent_root = btrfs_extent_root(fs_info, 0);
> +	/* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */
> +	if (IS_ERR(extent_root)) {
> +		btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling");
> +		btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY);
> +		return 0;
> +	}


I saw that someone tested a patch for this bug but it doesn't show the
patch itself...

https://lore.kernel.org/all/0000000000004417f5062141fe65@google.com/

Smatch says that btrfs_extent_root() can't return error pointers.  I
would have expected an error pointer dereference to crash in
btrfs_comp_cpu_keys().  The pointer in the bug report
0xdffffc0000000003 is not an error pointer.  What am I missing?

regards,
dan carpenter