[Report] corrupted root csum tree result in segfault.

[Report] corrupted root csum tree result in segfault.

[Anand Jain]

# mkfs.btrfs /dev/sdd && btrfs-debug-tree -R /dev/sdd | egrep checksum

::
checksum tree key (CSUM_TREE ROOT_ITEM 0) 29376512 level 0

# btrfs-corrupt-block -l 29376512 /dev/sdd
mirror 1 logical 29376512 physical 37765120 device /dev/sdd
corrupting 29376512 copy 1
mirror 2 logical 29376512 physical 145113088 device /dev/sdd
corrupting 29376512 copy 2
# btrfsck /dev/sdd
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
read block failed check_tree_block
Couldn't setup csum tree
checking extents
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
Check tree block failed, want=29376512, have=0
read block failed check_tree_block  <---- !!
Segmentation fault (core dumped)  <--- !!
#
----------------


read_tree_block frees buf and returns NULL
----------------
struct extent_buffer *read_tree_block(struct btrfs_root *root, u64 bytenr,
                                      u32 blocksize, u64 parent_transid)
{
::

         while (1) {
::
                 if (ignore) {
                         if (check_tree_block(root, eb))
                                 printk("read block failed check_tree_block\n"); <----
                         else
                                 printk("Csum didn't match\n");
                         break;
                 }
::
         }
         free_extent_buffer(eb);
         return NULL;
}
----------------

we don't check if the buf is NULL and fails with
Segmentation faults in add_root_to_pending
---------------------
static int check_extents(struct btrfs_trans_handle *trans,
                          struct btrfs_root *root, int repair)
{

::
                         buf = read_tree_block(root->fs_info->tree_root,
                                               btrfs_root_bytenr(&ri),
                                               btrfs_level_size(root,
                                                btrfs_root_level(&ri)), 0);   <--- buf is NULL

                         add_root_to_pending(buf, bits, bits_nr, &extent_cache,
                                             &pending, &seen, &reada, &nodes,
                                             &found_key);

                         free_extent_buffer(buf);
                 }
-----------------------


Seems like the simple fix is to redirect btrfsck user to use
--init-csum-tree when csum root is corrupted

thanks
Anand

[PATCH] Seg fault when csum-tree root is corrupted.

[Anand jain]

From: Anand Jain <anand.jain@oracle.com>

Segmentation fault with the following trace when csum-tree is
deliberately corrupted using btrfs-corrupt-block

read block failed check_tree_block
Couldn't setup csum tree
checking extents
Check tree block failed, want=29376512, have=0
::
read block failed check_tree_block <---- !!
Segmentation fault (core dumped) <--- !!

The below fix will redirect btrfsck user to use --init-csum-tree
when csum root is corrupted
---
 btrfsck.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/btrfsck.c b/btrfsck.c
index 7aac736..6ced7b5 100644
--- a/btrfsck.c
+++ b/btrfsck.c
@@ -3483,6 +3483,10 @@ int main(int ac, char **av)
 		fprintf(stderr, "Critical roots corrupted, unable to fsck the FS\n");
 		return -EIO;
 	}
+	if (!extent_buffer_uptodate(info->csum_root->node) && !init_csum_tree) {
+		fprintf(stderr, "Checksum root corrupted, run 'btrfsck --init-csum-tree'\n");
+		return -EIO;
+	}
 
 	root = info->fs_root;
 
-- 
1.7.1