[PATCH 0/6] add sanity check for extent inline ref type

[PATCH 0/6] add sanity check for extent inline ref type

[Liu Bo]

An invalid extent inline ref type could be read from a btrfs image and
it ends up with a panic[1], this set is to deal with the insane value
gracefully in patch 1-2 and clean up BUG() in the code in patch 3-5.

Patch 6 adds scrub support to detect the corruption, so users can be
noticed when they do scrub on a regular basis.

I'm not sure in the real world what may result in this corruption, but
I've seen several reports on the ML about __btrfs_free_extent saying
something was missing (or simply wrong), while testing this set with
btrfs-corrupt-block, I found that switching ref type could end up that
situation as well, eg. a data extent's ref type
(BTRFS_EXTENT_DATA_REF_KEY) is switched to (BTRFS_TREE_BLOCK_REF_KEY).

Hopefully this can give people more sights next time when that
happens.

[1]:https://www.spinics.net/lists/linux-btrfs/msg65646.html

Liu Bo (6):
  Btrfs: add a helper to retrive extent inline ref type
  Btrfs: convert to use btrfs_get_extent_inline_ref_type
  Btrfs: remove BUG() in btrfs_extent_inline_ref_size
  Btrfs: remove BUG() in print_extent_item
  Btrfs: remove BUG() in add_data_reference
  Btrfs: add sanity check of extent item in scrub

 fs/btrfs/backref.c     |  9 +++++--
 fs/btrfs/ctree.h       |  5 +++-
 fs/btrfs/extent-tree.c | 68 ++++++++++++++++++++++++++++++++++++++++++++------
 fs/btrfs/print-tree.c  |  8 +++++-
 fs/btrfs/relocation.c  | 20 ++++++++++++---
 fs/btrfs/scrub.c       | 43 +++++++++++++++++++++++++++++++
 6 files changed, 139 insertions(+), 14 deletions(-)

-- 
2.9.4

[PATCH 1/6] Btrfs: add a helper to retrive extent inline ref type

[Liu Bo]

An invalid value of extent inline ref type may be read from a
malicious image which may force btrfs to crash.

This adds a helper which does sanity check for the ref type, so we can
know if it's sane, return type if so, otherwise return an error.

Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
 fs/btrfs/ctree.h       |  4 ++++
 fs/btrfs/extent-tree.c | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index c411590..206ae8c 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2542,6 +2542,10 @@ static inline gfp_t btrfs_alloc_write_mask(struct address_space *mapping)
 
 /* extent-tree.c */
 
+int btrfs_get_extent_inline_ref_type(struct extent_buffer *eb,
+				     struct btrfs_extent_inline_ref *iref,
+				     int is_data);
+
 u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
 
 static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index be54776..fba8ca0 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1117,6 +1117,41 @@ static int convert_extent_item_v0(struct btrfs_trans_handle *trans,
 }
 #endif
 
+/*
+ * is_data == 0, tree block type is required,
+ * is_data == 1, data type is requried,
+ * is_data == 2, either type is OK.
+ */
+int btrfs_get_extent_inline_ref_type(struct extent_buffer *eb,
+				     struct btrfs_extent_inline_ref *iref,
+				     int is_data)
+{
+	int type = btrfs_extent_inline_ref_type(eb, iref);
+
+	if (type == BTRFS_TREE_BLOCK_REF_KEY ||
+	    type == BTRFS_SHARED_BLOCK_REF_KEY ||
+	    type == BTRFS_SHARED_DATA_REF_KEY ||
+	    type == BTRFS_EXTENT_DATA_REF_KEY) {
+		if (is_data == 2) {
+			return type;
+		} else if (is_data == 1) {
+			if (type == BTRFS_EXTENT_DATA_REF_KEY ||
+			    type == BTRFS_SHARED_DATA_REF_KEY)
+				return type;
+		} else {
+			if (type == BTRFS_TREE_BLOCK_REF_KEY ||
+			    type == BTRFS_SHARED_BLOCK_REF_KEY)
+				return type;
+		}
+	}
+
+	btrfs_print_leaf(eb->fs_info, eb);
+	WARN(1, "eb %llu(%s block) invalid extent inline ref type %d\n",
+	     eb->start, (is_data) ? "data" : "tree", type);
+
+	return -EINVAL;
+}
+
 static u64 hash_extent_data_ref(u64 root_objectid, u64 owner, u64 offset)
 {
 	u32 high_crc = ~(u32)0;
-- 
2.9.4

Re: [PATCH 1/6] Btrfs: add a helper to retrive extent inline ref type

[Nikolay Borisov]

On 26.05.2017 03:26, Liu Bo wrote:
> An invalid value of extent inline ref type may be read from a
> malicious image which may force btrfs to crash.
> 
> This adds a helper which does sanity check for the ref type, so we can
> know if it's sane, return type if so, otherwise return an error.
> 
> Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> ---
>  fs/btrfs/ctree.h       |  4 ++++
>  fs/btrfs/extent-tree.c | 35 +++++++++++++++++++++++++++++++++++
>  2 files changed, 39 insertions(+)
> 
> diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
> index c411590..206ae8c 100644
> --- a/fs/btrfs/ctree.h
> +++ b/fs/btrfs/ctree.h
> @@ -2542,6 +2542,10 @@ static inline gfp_t btrfs_alloc_write_mask(struct address_space *mapping)
>  
>  /* extent-tree.c */
>  
> +int btrfs_get_extent_inline_ref_type(struct extent_buffer *eb,
> +				     struct btrfs_extent_inline_ref *iref,
> +				     int is_data);
> +
>  u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
>  
>  static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
> diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
> index be54776..fba8ca0 100644
> --- a/fs/btrfs/extent-tree.c
> +++ b/fs/btrfs/extent-tree.c
> @@ -1117,6 +1117,41 @@ static int convert_extent_item_v0(struct btrfs_trans_handle *trans,
>  }
>  #endif
>  
> +/*
> + * is_data == 0, tree block type is required,
> + * is_data == 1, data type is requried,
> + * is_data == 2, either type is OK.
> + */

Can you change those numbers to either #defines or better an enum type?
Looking at one call site the last argument being a number says nothing
and one has to context switch to the function definition. E.g. from
patch2 :

*out_type = btrfs_get_extent_inline_ref_type(eb, *out_eiref, 2);

possible names:

BTRFS_BLOCK_REF_TYPE
BTRFS_DATA_REF_TYPE
BTRFS_ANY_TYPE

> +int btrfs_get_extent_inline_ref_type(struct extent_buffer *eb,
> +				     struct btrfs_extent_inline_ref *iref,
> +				     int is_data)
> +{
> +	int type = btrfs_extent_inline_ref_type(eb, iref);
> +
> +	if (type == BTRFS_TREE_BLOCK_REF_KEY ||
> +	    type == BTRFS_SHARED_BLOCK_REF_KEY ||
> +	    type == BTRFS_SHARED_DATA_REF_KEY ||
> +	    type == BTRFS_EXTENT_DATA_REF_KEY) {
> +		if (is_data == 2) {
> +			return type;
> +		} else if (is_data == 1) {
> +			if (type == BTRFS_EXTENT_DATA_REF_KEY ||
> +			    type == BTRFS_SHARED_DATA_REF_KEY)
> +				return type;
> +		} else {
> +			if (type == BTRFS_TREE_BLOCK_REF_KEY ||
> +			    type == BTRFS_SHARED_BLOCK_REF_KEY)
> +				return type;
> +		}
> +	}
> +
> +	btrfs_print_leaf(eb->fs_info, eb);
> +	WARN(1, "eb %llu(%s block) invalid extent inline ref type %d\n",
> +	     eb->start, (is_data) ? "data" : "tree", type);
> +
> +	return -EINVAL;
> +}
> +
>  static u64 hash_extent_data_ref(u64 root_objectid, u64 owner, u64 offset)
>  {
>  	u32 high_crc = ~(u32)0;
> 

Re: [PATCH 1/6] Btrfs: add a helper to retrive extent inline ref type

[Jeff Mahoney]

[-- Attachment #1.1: Type: text/plain, Size: 3376 bytes --]

On 5/26/17 3:09 AM, Nikolay Borisov wrote:
> 
> 
> On 26.05.2017 03:26, Liu Bo wrote:
>> An invalid value of extent inline ref type may be read from a
>> malicious image which may force btrfs to crash.
>>
>> This adds a helper which does sanity check for the ref type, so we can
>> know if it's sane, return type if so, otherwise return an error.
>>
>> Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
>> ---
>>  fs/btrfs/ctree.h       |  4 ++++
>>  fs/btrfs/extent-tree.c | 35 +++++++++++++++++++++++++++++++++++
>>  2 files changed, 39 insertions(+)
>>
>> diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
>> index c411590..206ae8c 100644
>> --- a/fs/btrfs/ctree.h
>> +++ b/fs/btrfs/ctree.h
>> @@ -2542,6 +2542,10 @@ static inline gfp_t btrfs_alloc_write_mask(struct address_space *mapping)
>>  
>>  /* extent-tree.c */
>>  
>> +int btrfs_get_extent_inline_ref_type(struct extent_buffer *eb,
>> +				     struct btrfs_extent_inline_ref *iref,
>> +				     int is_data);
>> +
>>  u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
>>  
>>  static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
>> diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
>> index be54776..fba8ca0 100644
>> --- a/fs/btrfs/extent-tree.c
>> +++ b/fs/btrfs/extent-tree.c
>> @@ -1117,6 +1117,41 @@ static int convert_extent_item_v0(struct btrfs_trans_handle *trans,
>>  }
>>  #endif
>>  
>> +/*
>> + * is_data == 0, tree block type is required,
>> + * is_data == 1, data type is requried,
>> + * is_data == 2, either type is OK.
>> + */
> 
> Can you change those numbers to either #defines or better an enum type?
> Looking at one call site the last argument being a number says nothing
> and one has to context switch to the function definition. E.g. from
> patch2 :
> 
> *out_type = btrfs_get_extent_inline_ref_type(eb, *out_eiref, 2);
> 
> possible names:
> 
> BTRFS_BLOCK_REF_TYPE
> BTRFS_DATA_REF_TYPE
> BTRFS_ANY_TYPE

Agreed.

-Jeff

>> +int btrfs_get_extent_inline_ref_type(struct extent_buffer *eb,
>> +				     struct btrfs_extent_inline_ref *iref,
>> +				     int is_data)
>> +{
>> +	int type = btrfs_extent_inline_ref_type(eb, iref);
>> +
>> +	if (type == BTRFS_TREE_BLOCK_REF_KEY ||
>> +	    type == BTRFS_SHARED_BLOCK_REF_KEY ||
>> +	    type == BTRFS_SHARED_DATA_REF_KEY ||
>> +	    type == BTRFS_EXTENT_DATA_REF_KEY) {
>> +		if (is_data == 2) {
>> +			return type;
>> +		} else if (is_data == 1) {
>> +			if (type == BTRFS_EXTENT_DATA_REF_KEY ||
>> +			    type == BTRFS_SHARED_DATA_REF_KEY)
>> +				return type;
>> +		} else {
>> +			if (type == BTRFS_TREE_BLOCK_REF_KEY ||
>> +			    type == BTRFS_SHARED_BLOCK_REF_KEY)
>> +				return type;
>> +		}
>> +	}
>> +
>> +	btrfs_print_leaf(eb->fs_info, eb);
>> +	WARN(1, "eb %llu(%s block) invalid extent inline ref type %d\n",
>> +	     eb->start, (is_data) ? "data" : "tree", type);
>> +
>> +	return -EINVAL;
>> +}
>> +
>>  static u64 hash_extent_data_ref(u64 root_objectid, u64 owner, u64 offset)
>>  {
>>  	u32 high_crc = ~(u32)0;
>>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 


-- 
Jeff Mahoney
SUSE Labs


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [PATCH 1/6] Btrfs: add a helper to retrive extent inline ref type

[David Sterba]

On Fri, May 26, 2017 at 10:09:54AM +0300, Nikolay Borisov wrote:
> 
> 
> On 26.05.2017 03:26, Liu Bo wrote:
> > An invalid value of extent inline ref type may be read from a
> > malicious image which may force btrfs to crash.
> > 
> > This adds a helper which does sanity check for the ref type, so we can
> > know if it's sane, return type if so, otherwise return an error.
> > 
> > Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> > ---
> >  fs/btrfs/ctree.h       |  4 ++++
> >  fs/btrfs/extent-tree.c | 35 +++++++++++++++++++++++++++++++++++
> >  2 files changed, 39 insertions(+)
> > 
> > diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
> > index c411590..206ae8c 100644
> > --- a/fs/btrfs/ctree.h
> > +++ b/fs/btrfs/ctree.h
> > @@ -2542,6 +2542,10 @@ static inline gfp_t btrfs_alloc_write_mask(struct address_space *mapping)
> >  
> >  /* extent-tree.c */
> >  
> > +int btrfs_get_extent_inline_ref_type(struct extent_buffer *eb,
> > +				     struct btrfs_extent_inline_ref *iref,
> > +				     int is_data);
> > +
> >  u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
> >  
> >  static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
> > diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
> > index be54776..fba8ca0 100644
> > --- a/fs/btrfs/extent-tree.c
> > +++ b/fs/btrfs/extent-tree.c
> > @@ -1117,6 +1117,41 @@ static int convert_extent_item_v0(struct btrfs_trans_handle *trans,
> >  }
> >  #endif
> >  
> > +/*
> > + * is_data == 0, tree block type is required,
> > + * is_data == 1, data type is requried,
> > + * is_data == 2, either type is OK.
> > + */
> 
> Can you change those numbers to either #defines or better an enum type?
> Looking at one call site the last argument being a number says nothing
> and one has to context switch to the function definition. E.g. from
> patch2 :
> 
> *out_type = btrfs_get_extent_inline_ref_type(eb, *out_eiref, 2);
> 
> possible names:
> 
> BTRFS_BLOCK_REF_TYPE
> BTRFS_DATA_REF_TYPE
> BTRFS_ANY_TYPE

Can we please keep the namespace, BTRFS_ANY_TYPE is way too generic.

Suggested: BTRFS_REF_TYPE_BLOCK, BTRFS_REF_TYPE_DATA,
BTRFS_REF_TYPE_ANY.

Re: [PATCH 1/6] Btrfs: add a helper to retrive extent inline ref type

[David Sterba]

On Fri, May 26, 2017 at 08:13:05PM +0200, David Sterba wrote:
> On Fri, May 26, 2017 at 10:09:54AM +0300, Nikolay Borisov wrote:
> > 
> > 
> > On 26.05.2017 03:26, Liu Bo wrote:
> > > An invalid value of extent inline ref type may be read from a
> > > malicious image which may force btrfs to crash.
> > > 
> > > This adds a helper which does sanity check for the ref type, so we can
> > > know if it's sane, return type if so, otherwise return an error.
> > > 
> > > Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> > > ---
> > >  fs/btrfs/ctree.h       |  4 ++++
> > >  fs/btrfs/extent-tree.c | 35 +++++++++++++++++++++++++++++++++++
> > >  2 files changed, 39 insertions(+)
> > > 
> > > diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
> > > index c411590..206ae8c 100644
> > > --- a/fs/btrfs/ctree.h
> > > +++ b/fs/btrfs/ctree.h
> > > @@ -2542,6 +2542,10 @@ static inline gfp_t btrfs_alloc_write_mask(struct address_space *mapping)
> > >  
> > >  /* extent-tree.c */
> > >  
> > > +int btrfs_get_extent_inline_ref_type(struct extent_buffer *eb,
> > > +				     struct btrfs_extent_inline_ref *iref,
> > > +				     int is_data);
> > > +
> > >  u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
> > >  
> > >  static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
> > > diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
> > > index be54776..fba8ca0 100644
> > > --- a/fs/btrfs/extent-tree.c
> > > +++ b/fs/btrfs/extent-tree.c
> > > @@ -1117,6 +1117,41 @@ static int convert_extent_item_v0(struct btrfs_trans_handle *trans,
> > >  }
> > >  #endif
> > >  
> > > +/*
> > > + * is_data == 0, tree block type is required,
> > > + * is_data == 1, data type is requried,
> > > + * is_data == 2, either type is OK.
> > > + */
> > 
> > Can you change those numbers to either #defines or better an enum type?
> > Looking at one call site the last argument being a number says nothing
> > and one has to context switch to the function definition. E.g. from
> > patch2 :
> > 
> > *out_type = btrfs_get_extent_inline_ref_type(eb, *out_eiref, 2);
> > 
> > possible names:
> > 
> > BTRFS_BLOCK_REF_TYPE
> > BTRFS_DATA_REF_TYPE
> > BTRFS_ANY_TYPE
> 
> Can we please keep the namespace, BTRFS_ANY_TYPE is way too generic.
> 
> Suggested: BTRFS_REF_TYPE_BLOCK, BTRFS_REF_TYPE_DATA,
> BTRFS_REF_TYPE_ANY.

And to let the function return the enum, add BTRFS_REF_TYPE_INVALID with
value 0.

[PATCH 2/6] Btrfs: convert to use btrfs_get_extent_inline_ref_type

[Liu Bo]

Since we have a helper which can do sanity check, this converts all
btrfs_extent_inline_ref_type to it.

Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
 fs/btrfs/backref.c     |  9 +++++++--
 fs/btrfs/extent-tree.c | 33 ++++++++++++++++++++++++++-------
 fs/btrfs/relocation.c  | 15 +++++++++++++--
 3 files changed, 46 insertions(+), 11 deletions(-)

diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 7699e16..6ffc6bb 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1009,7 +1009,10 @@ static int __add_inline_refs(struct btrfs_path *path, u64 bytenr,
 		int type;
 
 		iref = (struct btrfs_extent_inline_ref *)ptr;
-		type = btrfs_extent_inline_ref_type(leaf, iref);
+		type = btrfs_get_extent_inline_ref_type(leaf, iref, 2);
+		if (type == -EINVAL)
+			return -EINVAL;
+
 		offset = btrfs_extent_inline_ref_offset(leaf, iref);
 
 		switch (type) {
@@ -1905,7 +1908,9 @@ static int __get_extent_inline_ref(unsigned long *ptr, struct extent_buffer *eb,
 
 	end = (unsigned long)ei + item_size;
 	*out_eiref = (struct btrfs_extent_inline_ref *)(*ptr);
-	*out_type = btrfs_extent_inline_ref_type(eb, *out_eiref);
+	*out_type = btrfs_get_extent_inline_ref_type(eb, *out_eiref, 2);
+	if (*out_type == -EINVAL)
+		return -EINVAL;
 
 	*ptr += btrfs_extent_inline_ref_size(*out_type);
 	WARN_ON(*ptr > end);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index fba8ca0..ecbed56 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1421,12 +1421,18 @@ static noinline u32 extent_data_ref_count(struct btrfs_path *path,
 	struct btrfs_extent_data_ref *ref1;
 	struct btrfs_shared_data_ref *ref2;
 	u32 num_refs = 0;
+	int type;
 
 	leaf = path->nodes[0];
 	btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
 	if (iref) {
-		if (btrfs_extent_inline_ref_type(leaf, iref) ==
-		    BTRFS_EXTENT_DATA_REF_KEY) {
+		/*
+		 * If type is invalid, we should have bailed out earlier than
+		 * this call.
+		 */
+		type = btrfs_get_extent_inline_ref_type(leaf, iref, 1);
+		ASSERT(type > 0);
+		if (type == BTRFS_EXTENT_DATA_REF_KEY) {
 			ref1 = (struct btrfs_extent_data_ref *)(&iref->offset);
 			num_refs = btrfs_extent_data_ref_count(leaf, ref1);
 		} else {
@@ -1587,6 +1593,7 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
 	int ret;
 	int err = 0;
 	bool skinny_metadata = btrfs_fs_incompat(fs_info, SKINNY_METADATA);
+	int is_data = !!(owner >= BTRFS_FIRST_FREE_OBJECTID);
 
 	key.objectid = bytenr;
 	key.type = BTRFS_EXTENT_ITEM_KEY;
@@ -1603,7 +1610,7 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
 	 * Owner is our parent level, so we can just add one to get the level
 	 * for the block we are interested in.
 	 */
-	if (skinny_metadata && owner < BTRFS_FIRST_FREE_OBJECTID) {
+	if (skinny_metadata && !is_data) {
 		key.type = BTRFS_METADATA_ITEM_KEY;
 		key.offset = owner;
 	}
@@ -1685,7 +1692,12 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
 			break;
 		}
 		iref = (struct btrfs_extent_inline_ref *)ptr;
-		type = btrfs_extent_inline_ref_type(leaf, iref);
+		type = btrfs_get_extent_inline_ref_type(leaf, iref, is_data);
+		if (type == -EINVAL) {
+			err = -EINVAL;
+			goto out;
+		}
+
 		if (want < type)
 			break;
 		if (want > type) {
@@ -1877,7 +1889,12 @@ void update_inline_extent_backref(struct btrfs_fs_info *fs_info,
 	if (extent_op)
 		__run_delayed_extent_op(extent_op, leaf, ei);
 
-	type = btrfs_extent_inline_ref_type(leaf, iref);
+	/*
+	 * If type is invalid, we should have bailed out after
+	 * lookup_inline_extent_backref().
+	 */
+	type = btrfs_get_extent_inline_ref_type(leaf, iref, 2);
+	ASSERT(type > 0);
 
 	if (type == BTRFS_EXTENT_DATA_REF_KEY) {
 		dref = (struct btrfs_extent_data_ref *)(&iref->offset);
@@ -3146,6 +3163,7 @@ static noinline int check_committed_ref(struct btrfs_root *root,
 	struct btrfs_extent_item *ei;
 	struct btrfs_key key;
 	u32 item_size;
+	int type;
 	int ret;
 
 	key.objectid = bytenr;
@@ -3187,8 +3205,9 @@ static noinline int check_committed_ref(struct btrfs_root *root,
 		goto out;
 
 	iref = (struct btrfs_extent_inline_ref *)(ei + 1);
-	if (btrfs_extent_inline_ref_type(leaf, iref) !=
-	    BTRFS_EXTENT_DATA_REF_KEY)
+
+	type = btrfs_get_extent_inline_ref_type(leaf, iref, 1);
+	if (type != BTRFS_EXTENT_DATA_REF_KEY)
 		goto out;
 
 	ref = (struct btrfs_extent_data_ref *)(&iref->offset);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index d60df51..b043e200 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -799,9 +799,16 @@ struct backref_node *build_backref_tree(struct reloc_control *rc,
 		if (ptr < end) {
 			/* update key for inline back ref */
 			struct btrfs_extent_inline_ref *iref;
+			int type;
 			iref = (struct btrfs_extent_inline_ref *)ptr;
-			key.type = btrfs_extent_inline_ref_type(eb, iref);
+			type = btrfs_get_extent_inline_ref_type(eb, iref, 0);
+			if (type < 0) {
+				ret = type;
+				goto out;
+			}
+			key.type = type;
 			key.offset = btrfs_extent_inline_ref_offset(eb, iref);
+
 			WARN_ON(key.type != BTRFS_TREE_BLOCK_REF_KEY &&
 				key.type != BTRFS_SHARED_BLOCK_REF_KEY);
 		}
@@ -3740,6 +3747,7 @@ int add_data_references(struct reloc_control *rc,
 	u32 blocksize = rc->extent_root->fs_info->nodesize;
 	int ret = 0;
 	int err = 0;
+	int type = 0;
 
 	eb = path->nodes[0];
 	ptr = btrfs_item_ptr_offset(eb, path->slots[0]);
@@ -3753,7 +3761,10 @@ int add_data_references(struct reloc_control *rc,
 
 	while (ptr < end) {
 		iref = (struct btrfs_extent_inline_ref *)ptr;
-		key.type = btrfs_extent_inline_ref_type(eb, iref);
+		type = btrfs_get_extent_inline_ref_type(eb, iref, 1);
+		if (type < 0)
+			key.type = 0;
+
 		if (key.type == BTRFS_SHARED_DATA_REF_KEY) {
 			key.offset = btrfs_extent_inline_ref_offset(eb, iref);
 			ret = __add_tree_block(rc, key.offset, blocksize,
-- 
2.9.4

[PATCH 3/6] Btrfs: remove BUG() in btrfs_extent_inline_ref_size

[Liu Bo]

Now that btrfs_get_extent_inline_ref_type() can report if type is a
valid one and all callers can gracefully deal with that, we don't need
to crash here.

Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
 fs/btrfs/ctree.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 206ae8c..54bbac3 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1776,7 +1776,6 @@ static inline u32 btrfs_extent_inline_ref_size(int type)
 	if (type == BTRFS_EXTENT_DATA_REF_KEY)
 		return sizeof(struct btrfs_extent_data_ref) +
 		       offsetof(struct btrfs_extent_inline_ref, offset);
-	BUG();
 	return 0;
 }
 
-- 
2.9.4

[PATCH 4/6] Btrfs: remove BUG() in print_extent_item

[Liu Bo]

btrfs_print_leaf() is used in btrfs_get_extent_inline_ref_type, so
here we really want to print the invalid value of ref type instead of
causing a kernel panic.

Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
 fs/btrfs/print-tree.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
index fcae61e..4448be6 100644
--- a/fs/btrfs/print-tree.c
+++ b/fs/btrfs/print-tree.c
@@ -63,6 +63,7 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
 	u32 item_size = btrfs_item_size_nr(eb, slot);
 	u64 flags;
 	u64 offset;
+	int is_data;
 
 	if (item_size < sizeof(*ei)) {
 #ifdef BTRFS_COMPAT_EXTENT_TREE_V0
@@ -98,6 +99,8 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
 		iref = (struct btrfs_extent_inline_ref *)(ei + 1);
 	}
 
+	is_data = !!(flags & BTRFS_EXTENT_FLAG_DATA);
+
 	ptr = (unsigned long)iref;
 	end = (unsigned long)ei + item_size;
 	while (ptr < end) {
@@ -121,7 +124,10 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
 			       offset, btrfs_shared_data_ref_count(eb, sref));
 			break;
 		default:
-			BUG();
+			btrfs_err(eb->fs_info,
+				  "extent %llu has invalid ref type %d\n",
+				  eb->start, type);
+			return;
 		}
 		ptr += btrfs_extent_inline_ref_size(type);
 	}
-- 
2.9.4

Re: [PATCH 4/6] Btrfs: remove BUG() in print_extent_item

[David Sterba]

On Thu, May 25, 2017 at 06:26:29PM -0600, Liu Bo wrote:
> btrfs_print_leaf() is used in btrfs_get_extent_inline_ref_type, so
> here we really want to print the invalid value of ref type instead of
> causing a kernel panic.
> 
> Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> ---
>  fs/btrfs/print-tree.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
> index fcae61e..4448be6 100644
> --- a/fs/btrfs/print-tree.c
> +++ b/fs/btrfs/print-tree.c
> @@ -63,6 +63,7 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
>  	u32 item_size = btrfs_item_size_nr(eb, slot);
>  	u64 flags;
>  	u64 offset;
> +	int is_data;
>  
>  	if (item_size < sizeof(*ei)) {
>  #ifdef BTRFS_COMPAT_EXTENT_TREE_V0
> @@ -98,6 +99,8 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
>  		iref = (struct btrfs_extent_inline_ref *)(ei + 1);
>  	}
>  
> +	is_data = !!(flags & BTRFS_EXTENT_FLAG_DATA);
> +
>  	ptr = (unsigned long)iref;
>  	end = (unsigned long)ei + item_size;
>  	while (ptr < end) {
> @@ -121,7 +124,10 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
>  			       offset, btrfs_shared_data_ref_count(eb, sref));
>  			break;
>  		default:
> -			BUG();
> +			btrfs_err(eb->fs_info,
> +				  "extent %llu has invalid ref type %d\n",
> +				  eb->start, type);
> +			return;

I don't see is_data used anywhere, also not in the followup patches.
Please use a bool type in case it's valid here.

>  		}
>  		ptr += btrfs_extent_inline_ref_size(type);
>  	}
> -- 
> 2.9.4
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 4/6] Btrfs: remove BUG() in print_extent_item

[Liu Bo]

On Fri, May 26, 2017 at 08:18:22PM +0200, David Sterba wrote:
> On Thu, May 25, 2017 at 06:26:29PM -0600, Liu Bo wrote:
> > btrfs_print_leaf() is used in btrfs_get_extent_inline_ref_type, so
> > here we really want to print the invalid value of ref type instead of
> > causing a kernel panic.
> > 
> > Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> > ---
> >  fs/btrfs/print-tree.c | 8 +++++++-
> >  1 file changed, 7 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
> > index fcae61e..4448be6 100644
> > --- a/fs/btrfs/print-tree.c
> > +++ b/fs/btrfs/print-tree.c
> > @@ -63,6 +63,7 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
> >  	u32 item_size = btrfs_item_size_nr(eb, slot);
> >  	u64 flags;
> >  	u64 offset;
> > +	int is_data;
> >  
> >  	if (item_size < sizeof(*ei)) {
> >  #ifdef BTRFS_COMPAT_EXTENT_TREE_V0
> > @@ -98,6 +99,8 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
> >  		iref = (struct btrfs_extent_inline_ref *)(ei + 1);
> >  	}
> >  
> > +	is_data = !!(flags & BTRFS_EXTENT_FLAG_DATA);
> > +
> >  	ptr = (unsigned long)iref;
> >  	end = (unsigned long)ei + item_size;
> >  	while (ptr < end) {
> > @@ -121,7 +124,10 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
> >  			       offset, btrfs_shared_data_ref_count(eb, sref));
> >  			break;
> >  		default:
> > -			BUG();
> > +			btrfs_err(eb->fs_info,
> > +				  "extent %llu has invalid ref type %d\n",
> > +				  eb->start, type);
> > +			return;
> 
> I don't see is_data used anywhere, also not in the followup patches.
> Please use a bool type in case it's valid here.
>

Good catch, I should remove is_data since it uses the original
btrfs_extent_inline_ref_type directly, will update it.

thanks,
-liubo


> >  		}
> >  		ptr += btrfs_extent_inline_ref_size(type);
> >  	}
> > -- 
> > 2.9.4
> > 
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 5/6] Btrfs: remove BUG() in add_data_reference

[Liu Bo]

Now that we have a helper to report invalid value of extent inline ref
type, we need to quit gracefully instead of throwing out a kernel panic.

Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
 fs/btrfs/relocation.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index b043e200..8b984bd 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3774,7 +3774,10 @@ int add_data_references(struct reloc_control *rc,
 			ret = find_data_references(rc, extent_key,
 						   eb, dref, blocks);
 		} else {
-			BUG();
+			ret = -EINVAL;
+			WARN(1,
+			     "extent %llu has an invalid inline ref type\n",
+			     eb->start);
 		}
 		if (ret) {
 			err = ret;
-- 
2.9.4

Re: [PATCH 5/6] Btrfs: remove BUG() in add_data_reference

[David Sterba]

On Thu, May 25, 2017 at 06:26:30PM -0600, Liu Bo wrote:
> Now that we have a helper to report invalid value of extent inline ref
> type, we need to quit gracefully instead of throwing out a kernel panic.
> 
> Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> ---
>  fs/btrfs/relocation.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
> index b043e200..8b984bd 100644
> --- a/fs/btrfs/relocation.c
> +++ b/fs/btrfs/relocation.c
> @@ -3774,7 +3774,10 @@ int add_data_references(struct reloc_control *rc,
>  			ret = find_data_references(rc, extent_key,
>  						   eb, dref, blocks);
>  		} else {
> -			BUG();
> +			ret = -EINVAL;
> +			WARN(1,
> +			     "extent %llu has an invalid inline ref type\n",
> +			     eb->start);

Would be good to extend the error message, also in the previous patch.
Print inode number, root id and the (invalid ref) type.

>  		}
>  		if (ret) {
>  			err = ret;
> -- 
> 2.9.4
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 5/6] Btrfs: remove BUG() in add_data_reference

[Liu Bo]

On Fri, May 26, 2017 at 08:20:11PM +0200, David Sterba wrote:
> On Thu, May 25, 2017 at 06:26:30PM -0600, Liu Bo wrote:
> > Now that we have a helper to report invalid value of extent inline ref
> > type, we need to quit gracefully instead of throwing out a kernel panic.
> > 
> > Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> > ---
> >  fs/btrfs/relocation.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
> > index b043e200..8b984bd 100644
> > --- a/fs/btrfs/relocation.c
> > +++ b/fs/btrfs/relocation.c
> > @@ -3774,7 +3774,10 @@ int add_data_references(struct reloc_control *rc,
> >  			ret = find_data_references(rc, extent_key,
> >  						   eb, dref, blocks);
> >  		} else {
> > -			BUG();
> > +			ret = -EINVAL;
> > +			WARN(1,
> > +			     "extent %llu has an invalid inline ref type\n",
> > +			     eb->start);
> 
> Would be good to extend the error message, also in the previous patch.
> Print inode number, root id and the (invalid ref) type.
> 

I've printed out the whole leaf's content in the helper
btrfs_get_extent_inline_ref_type if type is not valid, and it shows
the invalid ref type.

For inode number and root id, it's not available in this relocation
case, I'll check that in other patches.

thanks,
-liubo
> >  		}
> >  		if (ret) {
> >  			err = ret;
> > -- 
> > 2.9.4
> > 
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 6/6] Btrfs: add sanity check of extent item in scrub

[Liu Bo]

Currently scrub only verify checksum of both metadata and data and
couldn't detect an invalid extent_item.

This adds sanity check for extent item, now it can check if
extent_inline_ref_type is valid.

Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
 fs/btrfs/scrub.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index b0251eb..e87b752 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -3058,6 +3058,39 @@ static noinline_for_stack int scrub_raid56_parity(struct scrub_ctx *sctx,
 	return ret < 0 ? ret : 0;
 }
 
+static int check_extent_item(struct extent_buffer *l, int slot,
+			     struct btrfs_extent_item *ei, int key_type)
+{
+	unsigned long ptr;
+	unsigned long end;
+	struct btrfs_extent_inline_ref *iref;
+	u64 flags = btrfs_extent_flags(l, ei);
+	int is_data = !!(flags & BTRFS_EXTENT_FLAG_DATA);
+	int type;
+
+	ptr = (unsigned long)(ei + 1);
+	if (!is_data &&
+	    key_type != BTRFS_METADATA_ITEM_KEY)
+		ptr += sizeof(struct btrfs_tree_block_info);
+	end = (unsigned long)ei +
+		btrfs_item_size_nr(l, slot);
+
+	while (1) {
+		if (ptr >= end) {
+			WARN_ON(ptr > end);
+			break;
+		}
+
+		iref = (struct btrfs_extent_inline_ref *)ptr;
+		type = btrfs_get_extent_inline_ref_type(l, iref, is_data);
+		if (type < 0)
+			return type;
+
+		ptr += btrfs_extent_inline_ref_size(type);
+	}
+	return 0;
+}
+
 static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
 					   struct map_lookup *map,
 					   struct btrfs_device *scrub_dev,
@@ -3318,6 +3351,16 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
 				goto next;
 			}
 
+			/* sanity check for extent inline ref type */
+			if (check_extent_item(l, slot, extent, key.type)) {
+				btrfs_err(fs_info,
+					  "scrub: extent %llu(0x%llx) has an invalid extent inline ref type, ignored.",
+					  key.objectid, key.objectid);
+				spin_lock(&sctx->stat_lock);
+				sctx->stat.uncorrectable_errors++;
+				spin_unlock(&sctx->stat_lock);
+				goto next;
+			}
 again:
 			extent_logical = key.objectid;
 			extent_len = bytes;
-- 
2.9.4

Re: [PATCH 6/6] Btrfs: add sanity check of extent item in scrub

[David Sterba]

On Thu, May 25, 2017 at 06:26:31PM -0600, Liu Bo wrote:
> Currently scrub only verify checksum of both metadata and data and
> couldn't detect an invalid extent_item.

This is a different kind of check that scrub was never designed to do.
Scrub just verifies the checksums, not the sructural integrity. This has
been referred to as an "on-line fsck". AFAIK xfs does not use 'scrub' in
the same sense as btrfs, so things are going to be confusing for the
users.

The on-line fsck is still desired, but I'd like to see a discussion how
exactly it should work, whether to extend scrub or add a new ioctl etc.

> This adds sanity check for extent item, now it can check if
> extent_inline_ref_type is valid.
> 
> Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> ---
>  fs/btrfs/scrub.c | 43 +++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 43 insertions(+)
> 
> diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
> index b0251eb..e87b752 100644
> --- a/fs/btrfs/scrub.c
> +++ b/fs/btrfs/scrub.c
> @@ -3058,6 +3058,39 @@ static noinline_for_stack int scrub_raid56_parity(struct scrub_ctx *sctx,
>  	return ret < 0 ? ret : 0;
>  }
>  
> +static int check_extent_item(struct extent_buffer *l, int slot,

Please use 'eb' for the extent_buffer.

> +			     struct btrfs_extent_item *ei, int key_type)

key_type should be u8

> +{
> +	unsigned long ptr;
> +	unsigned long end;
> +	struct btrfs_extent_inline_ref *iref;
> +	u64 flags = btrfs_extent_flags(l, ei);
> +	int is_data = !!(flags & BTRFS_EXTENT_FLAG_DATA);
> +	int type;
> +
> +	ptr = (unsigned long)(ei + 1);
> +	if (!is_data &&
> +	    key_type != BTRFS_METADATA_ITEM_KEY)
> +		ptr += sizeof(struct btrfs_tree_block_info);
> +	end = (unsigned long)ei +
> +		btrfs_item_size_nr(l, slot);

This will fit to one line

> +
> +	while (1) {
> +		if (ptr >= end) {
> +			WARN_ON(ptr > end);

Please add some verbose error message or get rid of the WARN_ON
completely if possible.

> +			break;
> +		}
> +
> +		iref = (struct btrfs_extent_inline_ref *)ptr;
> +		type = btrfs_get_extent_inline_ref_type(l, iref, is_data);
> +		if (type < 0)
> +			return type;
> +
> +		ptr += btrfs_extent_inline_ref_size(type);
> +	}
> +	return 0;
> +}
> +
>  static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
>  					   struct map_lookup *map,
>  					   struct btrfs_device *scrub_dev,
> @@ -3318,6 +3351,16 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
>  				goto next;
>  			}
>  
> +			/* sanity check for extent inline ref type */
> +			if (check_extent_item(l, slot, extent, key.type)) {
> +				btrfs_err(fs_info,
> +					  "scrub: extent %llu(0x%llx) has an invalid extent inline ref type, ignored.",

Strings can be un-indented to the left.

> +					  key.objectid, key.objectid);
> +				spin_lock(&sctx->stat_lock);
> +				sctx->stat.uncorrectable_errors++;

Yeah, this is an example where the uncorrectable_error would gain a new
meaning. We'd need to extend the scrub error reporting so the various
metadata errors get reported properly and not mangled with the rest.

> +				spin_unlock(&sctx->stat_lock);
> +				goto next;
> +			}
>  again:
>  			extent_logical = key.objectid;
>  			extent_len = bytes;

Re: [PATCH 6/6] Btrfs: add sanity check of extent item in scrub

[Liu Bo]

On Fri, May 26, 2017 at 08:33:16PM +0200, David Sterba wrote:
> On Thu, May 25, 2017 at 06:26:31PM -0600, Liu Bo wrote:
> > Currently scrub only verify checksum of both metadata and data and
> > couldn't detect an invalid extent_item.
> 
> This is a different kind of check that scrub was never designed to do.
> Scrub just verifies the checksums, not the sructural integrity. This has
> been referred to as an "on-line fsck". AFAIK xfs does not use 'scrub' in
> the same sense as btrfs, so things are going to be confusing for the
> users.
> 
> The on-line fsck is still desired, but I'd like to see a discussion how
> exactly it should work, whether to extend scrub or add a new ioctl etc.
>

I was hesitating about scrub vs online fsck when posting, just thought
it'd be good when users got this error while doing a regular scrub
ahead of really getting into trouble.  If we have a plan for online
fsck, I'm happy to let fsck do the job.

Or we can do this kind of sanity check at the time when reading the
eb.

Thanks,
-liubo

> > This adds sanity check for extent item, now it can check if
> > extent_inline_ref_type is valid.
> > 
> > Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> > ---
> >  fs/btrfs/scrub.c | 43 +++++++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 43 insertions(+)
> > 
> > diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
> > index b0251eb..e87b752 100644
> > --- a/fs/btrfs/scrub.c
> > +++ b/fs/btrfs/scrub.c
> > @@ -3058,6 +3058,39 @@ static noinline_for_stack int scrub_raid56_parity(struct scrub_ctx *sctx,
> >  	return ret < 0 ? ret : 0;
> >  }
> >  
> > +static int check_extent_item(struct extent_buffer *l, int slot,
> 
> Please use 'eb' for the extent_buffer.
> 
> > +			     struct btrfs_extent_item *ei, int key_type)
> 
> key_type should be u8
> 
> > +{
> > +	unsigned long ptr;
> > +	unsigned long end;
> > +	struct btrfs_extent_inline_ref *iref;
> > +	u64 flags = btrfs_extent_flags(l, ei);
> > +	int is_data = !!(flags & BTRFS_EXTENT_FLAG_DATA);
> > +	int type;
> > +
> > +	ptr = (unsigned long)(ei + 1);
> > +	if (!is_data &&
> > +	    key_type != BTRFS_METADATA_ITEM_KEY)
> > +		ptr += sizeof(struct btrfs_tree_block_info);
> > +	end = (unsigned long)ei +
> > +		btrfs_item_size_nr(l, slot);
> 
> This will fit to one line
> 
> > +
> > +	while (1) {
> > +		if (ptr >= end) {
> > +			WARN_ON(ptr > end);
> 
> Please add some verbose error message or get rid of the WARN_ON
> completely if possible.
> 
> > +			break;
> > +		}
> > +
> > +		iref = (struct btrfs_extent_inline_ref *)ptr;
> > +		type = btrfs_get_extent_inline_ref_type(l, iref, is_data);
> > +		if (type < 0)
> > +			return type;
> > +
> > +		ptr += btrfs_extent_inline_ref_size(type);
> > +	}
> > +	return 0;
> > +}
> > +
> >  static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
> >  					   struct map_lookup *map,
> >  					   struct btrfs_device *scrub_dev,
> > @@ -3318,6 +3351,16 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
> >  				goto next;
> >  			}
> >  
> > +			/* sanity check for extent inline ref type */
> > +			if (check_extent_item(l, slot, extent, key.type)) {
> > +				btrfs_err(fs_info,
> > +					  "scrub: extent %llu(0x%llx) has an invalid extent inline ref type, ignored.",
> 
> Strings can be un-indented to the left.
> 
> > +					  key.objectid, key.objectid);
> > +				spin_lock(&sctx->stat_lock);
> > +				sctx->stat.uncorrectable_errors++;
> 
> Yeah, this is an example where the uncorrectable_error would gain a new
> meaning. We'd need to extend the scrub error reporting so the various
> metadata errors get reported properly and not mangled with the rest.
> 
> > +				spin_unlock(&sctx->stat_lock);
> > +				goto next;
> > +			}
> >  again:
> >  			extent_logical = key.objectid;
> >  			extent_len = bytes;
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 6/6] Btrfs: add sanity check of extent item in scrub

[Qu Wenruo]

At 05/27/2017 04:20 AM, Liu Bo wrote:
> On Fri, May 26, 2017 at 08:33:16PM +0200, David Sterba wrote:
>> On Thu, May 25, 2017 at 06:26:31PM -0600, Liu Bo wrote:
>>> Currently scrub only verify checksum of both metadata and data and
>>> couldn't detect an invalid extent_item.
>>
>> This is a different kind of check that scrub was never designed to do.
>> Scrub just verifies the checksums, not the sructural integrity. This has
>> been referred to as an "on-line fsck". AFAIK xfs does not use 'scrub' in
>> the same sense as btrfs, so things are going to be confusing for the
>> users.
>>
>> The on-line fsck is still desired, but I'd like to see a discussion how
>> exactly it should work, whether to extend scrub or add a new ioctl etc.
>>
> 
> I was hesitating about scrub vs online fsck when posting, just thought
> it'd be good when users got this error while doing a regular scrub
> ahead of really getting into trouble.  If we have a plan for online
> fsck, I'm happy to let fsck do the job.

IIRC on-line fsck will be too challenging for kernel.

Just check how current btrfs check does, it's doing tons of cross 
checking for lowmem mode or uses tons of memory to record forward refs 
and backward refs.

Doing it in kernel will be a disaster.

> 
> Or we can do this kind of sanity check at the time when reading the
> eb.

This seems more reasonable, just like what Su Yue did for 
inode_ref/dir_item/dir_index.

Thanks,
Qu
> 
> Thanks,
> -liubo
> 
>>> This adds sanity check for extent item, now it can check if
>>> extent_inline_ref_type is valid.
>>>
>>> Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
>>> ---
>>>   fs/btrfs/scrub.c | 43 +++++++++++++++++++++++++++++++++++++++++++
>>>   1 file changed, 43 insertions(+)
>>>
>>> diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
>>> index b0251eb..e87b752 100644
>>> --- a/fs/btrfs/scrub.c
>>> +++ b/fs/btrfs/scrub.c
>>> @@ -3058,6 +3058,39 @@ static noinline_for_stack int scrub_raid56_parity(struct scrub_ctx *sctx,
>>>   	return ret < 0 ? ret : 0;
>>>   }
>>>   
>>> +static int check_extent_item(struct extent_buffer *l, int slot,
>>
>> Please use 'eb' for the extent_buffer.
>>
>>> +			     struct btrfs_extent_item *ei, int key_type)
>>
>> key_type should be u8
>>
>>> +{
>>> +	unsigned long ptr;
>>> +	unsigned long end;
>>> +	struct btrfs_extent_inline_ref *iref;
>>> +	u64 flags = btrfs_extent_flags(l, ei);
>>> +	int is_data = !!(flags & BTRFS_EXTENT_FLAG_DATA);
>>> +	int type;
>>> +
>>> +	ptr = (unsigned long)(ei + 1);
>>> +	if (!is_data &&
>>> +	    key_type != BTRFS_METADATA_ITEM_KEY)
>>> +		ptr += sizeof(struct btrfs_tree_block_info);
>>> +	end = (unsigned long)ei +
>>> +		btrfs_item_size_nr(l, slot);
>>
>> This will fit to one line
>>
>>> +
>>> +	while (1) {
>>> +		if (ptr >= end) {
>>> +			WARN_ON(ptr > end);
>>
>> Please add some verbose error message or get rid of the WARN_ON
>> completely if possible.
>>
>>> +			break;
>>> +		}
>>> +
>>> +		iref = (struct btrfs_extent_inline_ref *)ptr;
>>> +		type = btrfs_get_extent_inline_ref_type(l, iref, is_data);
>>> +		if (type < 0)
>>> +			return type;
>>> +
>>> +		ptr += btrfs_extent_inline_ref_size(type);
>>> +	}
>>> +	return 0;
>>> +}
>>> +
>>>   static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
>>>   					   struct map_lookup *map,
>>>   					   struct btrfs_device *scrub_dev,
>>> @@ -3318,6 +3351,16 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
>>>   				goto next;
>>>   			}
>>>   
>>> +			/* sanity check for extent inline ref type */
>>> +			if (check_extent_item(l, slot, extent, key.type)) {
>>> +				btrfs_err(fs_info,
>>> +					  "scrub: extent %llu(0x%llx) has an invalid extent inline ref type, ignored.",
>>
>> Strings can be un-indented to the left.
>>
>>> +					  key.objectid, key.objectid);
>>> +				spin_lock(&sctx->stat_lock);
>>> +				sctx->stat.uncorrectable_errors++;
>>
>> Yeah, this is an example where the uncorrectable_error would gain a new
>> meaning. We'd need to extend the scrub error reporting so the various
>> metadata errors get reported properly and not mangled with the rest.
>>
>>> +				spin_unlock(&sctx->stat_lock);
>>> +				goto next;
>>> +			}
>>>   again:
>>>   			extent_logical = key.objectid;
>>>   			extent_len = bytes;
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> 

Re: [PATCH 6/6] Btrfs: add sanity check of extent item in scrub

[David Sterba]

On Mon, May 29, 2017 at 09:48:19AM +0800, Qu Wenruo wrote:
> 
> 
> At 05/27/2017 04:20 AM, Liu Bo wrote:
> > On Fri, May 26, 2017 at 08:33:16PM +0200, David Sterba wrote:
> >> On Thu, May 25, 2017 at 06:26:31PM -0600, Liu Bo wrote:
> >>> Currently scrub only verify checksum of both metadata and data and
> >>> couldn't detect an invalid extent_item.
> >>
> >> This is a different kind of check that scrub was never designed to do.
> >> Scrub just verifies the checksums, not the sructural integrity. This has
> >> been referred to as an "on-line fsck". AFAIK xfs does not use 'scrub' in
> >> the same sense as btrfs, so things are going to be confusing for the
> >> users.
> >>
> >> The on-line fsck is still desired, but I'd like to see a discussion how
> >> exactly it should work, whether to extend scrub or add a new ioctl etc.
> >>
> > 
> > I was hesitating about scrub vs online fsck when posting, just thought
> > it'd be good when users got this error while doing a regular scrub
> > ahead of really getting into trouble.  If we have a plan for online
> > fsck, I'm happy to let fsck do the job.
> 
> IIRC on-line fsck will be too challenging for kernel.

Ok, we should define what's considered a sane 'fsck' subset that can be
done in kernel.

> Just check how current btrfs check does, it's doing tons of cross 
> checking for lowmem mode or uses tons of memory to record forward refs 
> and backward refs.

Full cross-ref validation is obviously quite heavy in terms of memory
resources and potential impact on the filesystem work.

> Doing it in kernel will be a disaster.
> 
> > 
> > Or we can do this kind of sanity check at the time when reading the
> > eb.
> 
> This seems more reasonable, just like what Su Yue did for 
> inode_ref/dir_item/dir_index.

Yeah that's what I had in mind, local sanity checks from information
available at the time. We can add such check independently and not
caling them on-line fsck anyway, so we can avoid overloading the scrub
stats.

Re: [PATCH 0/6] add sanity check for extent inline ref type

[Ivan Sizov]

2017-05-26 3:26 GMT+03:00 Liu Bo <bo.li.liu@oracle.com>:
>Patch 6 adds scrub support to detect the corruption, so users can be
noticed when they do scrub on a regular basis.
>I'm not sure in the real world what may result in this corruption

I've caught this type of corruption in the wild. The big rsync backup
always ends with a kernel crash due to BUG() statement in
ctime.h:1779. After applying this patchset and running scrub I've got
following messages:

[sivan@fruestuck ~]$ dmesg | grep "invalid extent inline"
[ 8812.428673] eb 4631634034688(tree block) invalid extent inline ref type 0
[ 8812.429148] BTRFS error (device sdb1): scrub: extent
2994741510144(0x2b944810000) has an invalid extent inline ref type,
ignored.
[ 8812.430086] eb 4631634034688(tree block) invalid extent inline ref type 0
[ 8812.430569] BTRFS error (device sdb1): scrub: extent
2994741559296(0x2b94481c000) has an invalid extent inline ref type,
ignored.

How to find the cause of the corruption? Should I try to fix it, or it
is not dangerous for the filesystem? If I should, how to do that?

Re: [PATCH 0/6] add sanity check for extent inline ref type

[Liu Bo]

On Tue, May 30, 2017 at 05:05:09PM +0300, Ivan Sizov wrote:
> 2017-05-26 3:26 GMT+03:00 Liu Bo <bo.li.liu@oracle.com>:
> >Patch 6 adds scrub support to detect the corruption, so users can be
> noticed when they do scrub on a regular basis.
> >I'm not sure in the real world what may result in this corruption
> 
> I've caught this type of corruption in the wild. The big rsync backup
> always ends with a kernel crash due to BUG() statement in
> ctime.h:1779. After applying this patchset and running scrub I've got
> following messages:
> 
> [sivan@fruestuck ~]$ dmesg | grep "invalid extent inline"
> [ 8812.428673] eb 4631634034688(tree block) invalid extent inline ref type 0
> [ 8812.429148] BTRFS error (device sdb1): scrub: extent
> 2994741510144(0x2b944810000) has an invalid extent inline ref type,
> ignored.
> [ 8812.430086] eb 4631634034688(tree block) invalid extent inline ref type 0
> [ 8812.430569] BTRFS error (device sdb1): scrub: extent
> 2994741559296(0x2b94481c000) has an invalid extent inline ref type,
> ignored.
> 
> How to find the cause of the corruption? Should I try to fix it, or it
> is not dangerous for the filesystem? If I should, how to do that?

Did it also print a btree's leaf's content?  If yes, it could show us
which inline ref has the issue.

It's not easy to tell if it's dangerous because I have no idea what
type of extent "2994741559296(0x2b94481c000)" refers to.

The command 'btrfs check' in the latest btrfs-progs can fix my test
case, which is the simplest one (only touched the inline ref and
everything else remained the same).

Given that at least two users reported about this, I start thinking
about there's something wrong inside our btrfs code.

-liubo

Re: [PATCH 0/6] add sanity check for extent inline ref type

[Ivan Sizov]

2017-05-30 21:02 GMT+03:00 Liu Bo <bo.li.liu@oracle.com>:
> On Tue, May 30, 2017 at 05:05:09PM +0300, Ivan Sizov wrote:
>> 2017-05-26 3:26 GMT+03:00 Liu Bo <bo.li.liu@oracle.com>:
>> >Patch 6 adds scrub support to detect the corruption, so users can be
>> noticed when they do scrub on a regular basis.
>> >I'm not sure in the real world what may result in this corruption
>>
>> I've caught this type of corruption in the wild. The big rsync backup
>> always ends with a kernel crash due to BUG() statement in
>> ctime.h:1779. After applying this patchset and running scrub I've got
>> following messages:
>>
>> [sivan@fruestuck ~]$ dmesg | grep "invalid extent inline"
>> [ 8812.428673] eb 4631634034688(tree block) invalid extent inline ref type 0
>> [ 8812.429148] BTRFS error (device sdb1): scrub: extent
>> 2994741510144(0x2b944810000) has an invalid extent inline ref type,
>> ignored.
>> [ 8812.430086] eb 4631634034688(tree block) invalid extent inline ref type 0
>> [ 8812.430569] BTRFS error (device sdb1): scrub: extent
>> 2994741559296(0x2b94481c000) has an invalid extent inline ref type,
>> ignored.
>>
>> How to find the cause of the corruption? Should I try to fix it, or it
>> is not dangerous for the filesystem? If I should, how to do that?
>
> Did it also print a btree's leaf's content?  If yes, it could show us
> which inline ref has the issue.

Yes, it does.

------------[ cut here ]------------
WARNING: CPU: 0 PID: 14133 at fs/btrfs/scrub.c:2506
scrub_stripe+0xe6f/0x1170 [btrfs]
Modules linked in: veth xt_nat ipt_MASQUERADE nf_nat_masquerade_ipv4
xt_addrtype br_netfilter nf_conntrack_netbios_ns
nf_conntrack_broadcast nf_conntrack_ftp xt_CT ip6t_rpfilter
ip6t_REJECT nf_reject_ipv6 ip_set nfnetlink ebtable_nat ebtable_broute
bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat
nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security
ebtable_filter ebtables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack
nf_conntrack libcrc32c ip6table_filter ip6_tables intel_powerclamp
coretemp kvm_intel kvm snd_hda_codec_realtek snd_hda_codec_generic
irqbypass snd_hda_intel intel_cstate snd_hda_codec intel_uncore ppdev
snd_hda_core snd_hwdep iTCO_wdt iTCO_vendor_support mei_wdt gpio_ich
snd_seq
 snd_seq_device snd_pcm snd_timer snd soundcore tpm_infineon mei_me
mei acpi_cpufreq tpm_tis parport_pc parport i2c_i801 tpm_tis_core
shpchp tpm lpc_ich nfsd auth_rpcgss nfs_acl lockd grace sunrpc
binfmt_misc btrfs hid_logitech_hidpp xor i915 raid6_pq crc32c_intel
video i2c_algo_bit drm_kms_helper serio_raw drm hid_logitech_dj uas
usb_storage r8169 mii
CPU: 0 PID: 14133 Comm: btrfs Not tainted
4.11.3-200.local.btrfs_patched.fc25.x86_64 #1
Hardware name: MSI MS-7636/H55M-P31(MS-7636)   , BIOS V1.9 09/14/2010
Call Trace:
 dump_stack+0x63/0x86
 __warn+0xcb/0xf0
 warn_slowpath_null+0x1d/0x20
 scrub_stripe+0xe6f/0x1170 [btrfs]
 scrub_chunk+0x102/0x140 [btrfs]
 ? scrub_chunk+0x102/0x140 [btrfs]
 scrub_enumerate_chunks+0x300/0x680 [btrfs]
 ? wake_atomic_t_function+0x60/0x70
 btrfs_scrub_dev+0x213/0x540 [btrfs]
 ? __mnt_want_write+0x56/0x60
 btrfs_ioctl+0x1351/0x2470 [btrfs]
 do_vfs_ioctl+0xa3/0x5f0
 ? do_vfs_ioctl+0xa3/0x5f0
 ? security_file_ioctl+0x43/0x60
 SyS_ioctl+0x79/0x90
 do_syscall_64+0x67/0x180
 entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7fa688cc4787
RSP: 002b:00007fa6873c2d58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00005572d3db7190 RCX: 00007fa688cc4787
RDX: 00005572d3db7190 RSI: 00000000c400941b RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fa6873c3700 R09: 0000000000000000
R10: 00007fa6873c3700 R11: 0000000000000246 R12: 00007fa6873c3500
R13: 00007ffc22fb28ef R14: 00007fa6873c39c0 R15: 00007fa6873c3700
---[ end trace 70deff6b302d4408 ]---
BTRFS info (device sdb1): leaf 2994891669504 total ptrs 121 free space 8284
        item 0 key (2994739920896 169 0) itemoff 16250 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278117376
        item 1 key (2994739937280 169 0) itemoff 16217 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 2 key (2994739953664 169 0) itemoff 16184 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 3 key (2994739970048 169 0) itemoff 16151 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 4 key (2994739986432 169 0) itemoff 16118 itemsize 33
                extent refs 1 gen 826970 flags 2
                tree block backref root 7
        item 5 key (2994740002816 169 0) itemoff 16085 itemsize 33
                extent refs 1 gen 983344 flags 2
                tree block backref root 7
        item 6 key (2994740019200 169 0) itemoff 16052 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 7 key (2994740035584 169 0) itemoff 16019 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 8 key (2994740051968 169 0) itemoff 15986 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 9 key (2994740068352 169 0) itemoff 15953 itemsize 33
                extent refs 1 gen 826970 flags 2
                tree block backref root 7
        item 10 key (2994740084736 169 0) itemoff 15920 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 11 key (2994740101120 169 0) itemoff 15887 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 12 key (2994740117504 169 0) itemoff 15854 itemsize 33
                extent refs 1 gen 1414389 flags 258
                shared block backref parent 4632584617984
        item 13 key (2994740133888 169 0) itemoff 15821 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 14 key (2994740150272 169 0) itemoff 15788 itemsize 33
                extent refs 1 gen 826970 flags 2
                tree block backref root 7
        item 15 key (2994740166656 169 0) itemoff 15755 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 16 key (2994740183040 169 0) itemoff 15722 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 17 key (2994740199424 169 0) itemoff 15689 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 18 key (2994740215808 169 0) itemoff 15647 itemsize 42
                extent refs 2 gen 1406394 flags 258
                shared block backref parent 4633401622528
                shared block backref parent 4627188744192
        item 19 key (2994740232192 169 0) itemoff 15614 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278150144
        item 20 key (2994740248576 169 0) itemoff 15581 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 21 key (2994740264960 169 0) itemoff 15548 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 22 key (2994740281344 169 0) itemoff 15515 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 23 key (2994740297728 169 0) itemoff 15482 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 24 key (2994740314112 169 0) itemoff 15440 itemsize 42
                extent refs 2 gen 1406394 flags 258
                shared block backref parent 4633401622528
                shared block backref parent 4627188744192
        item 25 key (2994740330496 169 0) itemoff 15407 itemsize 33
                extent refs 1 gen 827339 flags 258
                shared block backref parent 4037502517248
        item 26 key (2994740346880 169 0) itemoff 15374 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 27 key (2994740363264 169 0) itemoff 15332 itemsize 42
                extent refs 2 gen 1322391 flags 258
                shared block backref parent 4537765806080
                shared block backref parent 4537190842368
        item 28 key (2994740379648 169 0) itemoff 15290 itemsize 42
                extent refs 2 gen 1406394 flags 258
                shared block backref parent 4633401622528
                shared block backref parent 4627188744192
        item 29 key (2994740396032 169 0) itemoff 15230 itemsize 60
                extent refs 4 gen 826464 flags 258
                shared block backref parent 4037394251776
                shared block backref parent 4037222711296
                shared block backref parent 3213570605056
                shared block backref parent 3213569130496
        item 30 key (2994740412416 169 0) itemoff 15179 itemsize 51
                extent refs 3 gen 827339 flags 258
                shared block backref parent 3470248460288
                shared block backref parent 3470248443904
                shared block backref parent 3470248329216
        item 31 key (2994740428800 169 0) itemoff 15146 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 32 key (2994740461568 169 0) itemoff 15113 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 33 key (2994740477952 169 0) itemoff 15080 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 34 key (2994740510720 169 0) itemoff 15038 itemsize 42
                extent refs 2 gen 1414985 flags 2
                tree block backref root 23268
                shared block backref parent 4633738919936
        item 35 key (2994740527104 169 0) itemoff 15005 itemsize 33
                extent refs 1 gen 1262619 flags 258
                shared block backref parent 2994735022080
        item 36 key (2994740543488 169 0) itemoff 14972 itemsize 33
                extent refs 1 gen 1414571 flags 2
                tree block backref root 23268
        item 37 key (2994740559872 169 0) itemoff 14939 itemsize 33
                extent refs 1 gen 1414571 flags 2
                tree block backref root 23269
        item 38 key (2994740576256 169 0) itemoff 14870 itemsize 69
                extent refs 5 gen 1417199 flags 2
                tree block backref root 23268
                shared block backref parent 4634987790336
                shared block backref parent 4630838362112
                shared block backref parent 4630064791552
                shared block backref parent 4628769914880
        item 39 key (2994740592640 169 0) itemoff 14828 itemsize 42
                extent refs 2 gen 827339 flags 258
                shared block backref parent 4197157306368
                shared block backref parent 4197157257216
        item 40 key (2994740609024 169 0) itemoff 14795 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278117376
        item 41 key (2994740625408 169 0) itemoff 14717 itemsize 78
                extent refs 6 gen 831506 flags 258
                shared block backref parent 4240500473856
                shared block backref parent 4239944220672
                shared block backref parent 4197485166592
                shared block backref parent 4197485150208
                shared block backref parent 4197467586560
                shared block backref parent 4001359904768
        item 42 key (2994740641792 169 0) itemoff 14684 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278150144
        item 43 key (2994740674560 169 0) itemoff 14651 itemsize 33
                extent refs 1 gen 1264652 flags 258
                shared block backref parent 4196919754752
        item 44 key (2994740690944 169 0) itemoff 14591 itemsize 60
                extent refs 4 gen 827339 flags 258
                shared block backref parent 4240327262208
                shared block backref parent 4240083386368
                shared block backref parent 4197838585856
                shared block backref parent 4026387365888
        item 45 key (2994740707328 169 0) itemoff 14558 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 46 key (2994740723712 169 0) itemoff 14525 itemsize 33
                extent refs 1 gen 1400556 flags 258
                shared block backref parent 4636817702912
        item 47 key (2994740740096 169 0) itemoff 14492 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278117376
        item 48 key (2994740756480 169 0) itemoff 14459 itemsize 33
                extent refs 1 gen 1262619 flags 258
                shared block backref parent 4197476712448
        item 49 key (2994740772864 169 0) itemoff 14165 itemsize 294
                extent refs 30 gen 826464 flags 258
                tree block backref root 23269
                tree block backref root 22154
                tree block backref root 599
                shared block backref parent 4851402244096
                shared block backref parent 4635304804352
                shared block backref parent 4628579106816
                shared block backref parent 4628285816832
                shared block backref parent 4627642433536
                shared block backref parent 4537789579264
                shared block backref parent 4537419677696
                shared block backref parent 4537241993216
                shared block backref parent 4240853876736
                shared block backref parent 4240792502272
                shared block backref parent 4240286760960
                shared block backref parent 4197594628096
                shared block backref parent 4197489754112
                shared block backref parent 4197489377280
                shared block backref parent 4197489328128
                shared block backref parent 4197476712448
                shared block backref parent 4197107908608
                shared block backref parent 4001305739264
                shared block backref parent 4000873627648
                shared block backref parent 3918606139392
                shared block backref parent 3470774747136
                shared block backref parent 3213987184640
                shared block backref parent 3213552025600
                shared block backref parent 3213531414528
                shared block backref parent 2994976833536
                shared block backref parent 2994213994496
                shared block backref parent 2405100175360
        item 50 key (2994740789248 169 0) itemoff 13952 itemsize 213
                extent refs 21 gen 827339 flags 258
                tree block backref root 22154
                tree block backref root 599
                shared block backref parent 4627601620992
                shared block backref parent 4537810042880
                shared block backref parent 4537500680192
                shared block backref parent 4537357205504
                shared block backref parent 4537200869376
                shared block backref parent 4240320200704
                shared block backref parent 4240180199424
                shared block backref parent 4197591351296
                shared block backref parent 4197591269376
                shared block backref parent 4197324750848
                shared block backref parent 4196935434240
                shared block backref parent 4037456265216
                shared block backref parent 4027117404160
                shared block backref parent 3379070582784
                shared block backref parent 2993861459968
                shared block backref parent 2993423548416
                shared block backref parent 2941186490368
                shared block backref parent 2405627346944
                shared block backref parent 2405178884096
        item 51 key (2994740805632 169 0) itemoff 13919 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278150144
        item 52 key (2994740822016 169 0) itemoff 13886 itemsize 33
                extent refs 1 gen 832548 flags 2
                tree block backref root 7
        item 53 key (2994740838400 169 0) itemoff 13844 itemsize 42
                extent refs 2 gen 827339 flags 258
                shared block backref parent 4037502517248
                shared block backref parent 3918522187776
        item 54 key (2994740854784 169 0) itemoff 13811 itemsize 33
                extent refs 1 gen 1414662 flags 2
                tree block backref root 23268
        item 55 key (2994740887552 169 0) itemoff 13778 itemsize 33
                extent refs 1 gen 832548 flags 2
                tree block backref root 7
        item 56 key (2994740903936 169 0) itemoff 13736 itemsize 42
                extent refs 2 gen 827339 flags 258
                shared block backref parent 4037502517248
                shared block backref parent 3918522187776
        item 57 key (2994740920320 169 0) itemoff 13703 itemsize 33
                extent refs 1 gen 828860 flags 258
                shared block backref parent 4026247200768
        item 58 key (2994740936704 169 0) itemoff 13670 itemsize 33
                extent refs 1 gen 832548 flags 2
                tree block backref root 7
        item 59 key (2994740953088 169 0) itemoff 13628 itemsize 42
                extent refs 2 gen 1381556 flags 258
                shared block backref parent 3213982466048
                shared block backref parent 2994764578816
        item 60 key (2994740969472 169 0) itemoff 13595 itemsize 33
                extent refs 1 gen 1388773 flags 258
                shared block backref parent 4629308555264
        item 61 key (2994741002240 169 0) itemoff 13562 itemsize 33
                extent refs 1 gen 833647 flags 2
                tree block backref root 7
        item 62 key (2994741018624 169 0) itemoff 13529 itemsize 33
                extent refs 1 gen 828860 flags 258
                shared block backref parent 4026355630080
        item 63 key (2994741035008 169 0) itemoff 13460 itemsize 69
                extent refs 5 gen 1417199 flags 2
                tree block backref root 23268
                shared block backref parent 4634987790336
                shared block backref parent 4630838362112
                shared block backref parent 4630064791552
                shared block backref parent 4628769914880
        item 64 key (2994741051392 169 0) itemoff 13427 itemsize 33
                extent refs 1 gen 1417199 flags 2
                tree block backref root 2
        item 65 key (2994741067776 169 0) itemoff 13394 itemsize 33
                extent refs 1 gen 1414571 flags 2
                tree block backref root 23268
        item 66 key (2994741084160 169 0) itemoff 13343 itemsize 51
                extent refs 3 gen 1414985 flags 2
                tree block backref root 23268
                shared block backref parent 4850632065024
                shared block backref parent 4630524002304
        item 67 key (2994741100544 169 0) itemoff 13310 itemsize 33
                extent refs 1 gen 1401319 flags 258
                shared block backref parent 2404955914240
        item 68 key (2994741116928 169 0) itemoff 13277 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278117376
        item 69 key (2994741133312 169 0) itemoff 13244 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 70 key (2994741149696 169 0) itemoff 13211 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278150144
        item 71 key (2994741182464 169 0) itemoff 13178 itemsize 33
                extent refs 1 gen 1400556 flags 258
                shared block backref parent 4636825878528
        item 72 key (2994741198848 169 0) itemoff 13145 itemsize 33
                extent refs 1 gen 1372535 flags 2
                tree block backref root 1577
        item 73 key (2994741215232 169 0) itemoff 13112 itemsize 33
                extent refs 1 gen 1417199 flags 2
                tree block backref root 2
        item 74 key (2994741231616 169 0) itemoff 13079 itemsize 33
                extent refs 1 gen 1400556 flags 258
                shared block backref parent 4636824109056
        item 75 key (2994741248000 169 0) itemoff 13046 itemsize 33
                extent refs 1 gen 1263596 flags 258
                shared block backref parent 4196936613888
        item 76 key (2994741264384 169 0) itemoff 13013 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 77 key (2994741280768 169 0) itemoff 12980 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 78 key (2994741297152 169 0) itemoff 12947 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 79 key (2994741313536 169 0) itemoff 12914 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 80 key (2994741329920 169 0) itemoff 12746 itemsize 168
                extent refs 16 gen 827339 flags 258
                tree block backref root 600
                shared block backref parent 4628782678016
                shared block backref parent 4537392381952
                shared block backref parent 4537253691392
                shared block backref parent 4197723029504
                shared block backref parent 4197274419200
                shared block backref parent 4197047074816
                shared block backref parent 4037851742208
                shared block backref parent 4000956743680
                shared block backref parent 4000687423488
                shared block backref parent 4000453361664
                shared block backref parent 3918531346432
                shared block backref parent 3918469185536
                shared block backref parent 3213947092992
                shared block backref parent 2993295720448
                shared block backref parent 2477789478912
        item 81 key (2994741346304 169 0) itemoff 12713 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 82 key (2994741362688 169 0) itemoff 12680 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 83 key (2994741379072 169 0) itemoff 12647 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 84 key (2994741395456 169 0) itemoff 12614 itemsize 33
                extent refs 1 gen 1389683 flags 2
                tree block backref root 3095
        item 85 key (2994741411840 169 0) itemoff 12581 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 86 key (2994741428224 169 0) itemoff 12548 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 87 key (2994741444608 169 0) itemoff 12515 itemsize 33
                extent refs 1 gen 1401319 flags 258
                shared block backref parent 2404955914240
        item 88 key (2994741460992 169 0) itemoff 12482 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 89 key (2994741477376 169 0) itemoff 12404 itemsize 78
                extent refs 6 gen 827339 flags 258
                shared block backref parent 4197954289664
                shared block backref parent 4197954256896
                shared block backref parent 4197577523200
                shared block backref parent 4197571641344
                shared block backref parent 4000654016512
                shared block backref parent 3917758775296
        item 90 key (2994741493760 169 0) itemoff 12371 itemsize 33
                extent refs 811139072 gen 246284288 flags 0
                tree block backref root 1429
        item 91 key (2994741510144 169 0) itemoff 12338 itemsize 33
                extent refs 0 gen 0 flags 0
BTRFS error (device sdb1): extent 2994891669504 has invalid ref type 0
        item 92 key (2994741559296 169 0) itemoff 12305 itemsize 33
                extent refs 1 gen 1389525 flags 1578675552460472322
BTRFS error (device sdb1): extent 2994891669504 has invalid ref type 0
        item 93 key (2994741575680 169 0) itemoff 12272 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 94 key (2994741592064 169 0) itemoff 12230 itemsize 42
                extent refs 2 gen 1414178 flags 258
                shared block backref parent 2995019202560
                shared block backref parent 2993213603840
        item 95 key (2994741608448 169 0) itemoff 12197 itemsize 33
                extent refs 1 gen 1322391 flags 258
                shared block backref parent 2404909006848
        item 96 key (2994741624832 169 0) itemoff 12164 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 97 key (2994741641216 169 0) itemoff 12131 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 98 key (2994741657600 169 0) itemoff 12089 itemsize 42
                extent refs 2 gen 1417199 flags 2
                tree block backref root 23268
                shared block backref parent 5168957800448
        item 99 key (2994741673984 169 0) itemoff 12056 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 100 key (2994741690368 169 0) itemoff 12014 itemsize 42
                extent refs 2 gen 1322391 flags 258
                shared block backref parent 4537776128000
                shared block backref parent 4537233702912
        item 101 key (2994741706752 169 0) itemoff 11972 itemsize 42
                extent refs 2 gen 1417199 flags 2
                tree block backref root 23268
                shared block backref parent 5168957800448
        item 102 key (2994741723136 169 0) itemoff 11939 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 103 key (2994741739520 169 0) itemoff 11906 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 104 key (2994741755904 169 0) itemoff 11873 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 105 key (2994741772288 169 0) itemoff 11840 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 106 key (2994741788672 169 0) itemoff 11798 itemsize 42
                extent refs 2 gen 1374196 flags 258
                tree block backref root 23480
                shared block backref parent 2405081251840
        item 107 key (2994741805056 169 0) itemoff 11765 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 108 key (2994741821440 169 0) itemoff 11723 itemsize 42
                extent refs 2 gen 1414985 flags 2
                tree block backref root 23268
                shared block backref parent 4850630082560
        item 109 key (2994741837824 169 0) itemoff 11690 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 110 key (2994741854208 169 0) itemoff 11648 itemsize 42
                extent refs 2 gen 1374196 flags 258
                tree block backref root 23480
                shared block backref parent 2405081251840
        item 111 key (2994741870592 169 0) itemoff 11615 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 112 key (2994741886976 169 0) itemoff 11573 itemsize 42
                extent refs 2 gen 1417199 flags 2
                tree block backref root 23268
                shared block backref parent 5168957800448
        item 113 key (2994741903360 169 0) itemoff 11540 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 114 key (2994741919744 169 0) itemoff 11507 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 115 key (2994741936128 169 0) itemoff 11474 itemsize 33
                extent refs 1 gen 1401319 flags 258
                shared block backref parent 2404955914240
        item 116 key (2994741952512 169 0) itemoff 11441 itemsize 33
                extent refs 1 gen 1401319 flags 258
                shared block backref parent 2404955914240
        item 117 key (2994741968896 169 0) itemoff 11408 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 118 key (2994741985280 169 0) itemoff 11375 itemsize 33
                extent refs 1 gen 1414514 flags 2
                tree block backref root 23268
        item 119 key (2994742001664 169 0) itemoff 11342 itemsize 33
                extent refs 1 gen 827339 flags 258
                shared block backref parent 4037910560768
        item 120 key (2994742018048 169 0) itemoff 11309 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
------------[ cut here ]------------
WARNING: CPU: 0 PID: 14133 at fs/btrfs/extent-tree.c:1150
btrfs_get_extent_inline_ref_type+0xcb/0xe0 [btrfs]
eb 2994891669504(tree block) invalid extent inline ref type 0
Modules linked in: veth xt_nat ipt_MASQUERADE nf_nat_masquerade_ipv4
xt_addrtype br_netfilter nf_conntrack_netbios_ns
nf_conntrack_broadcast nf_conntrack_ftp xt_CT ip6t_rpfilter
ip6t_REJECT nf_reject_ipv6 ip_set nfnetlink ebtable_nat ebtable_broute
bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat
nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security
ebtable_filter ebtables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack
nf_conntrack libcrc32c ip6table_filter ip6_tables intel_powerclamp
coretemp kvm_intel kvm snd_hda_codec_realtek snd_hda_codec_generic
irqbypass snd_hda_intel intel_cstate snd_hda_codec intel_uncore ppdev
snd_hda_core snd_hwdep iTCO_wdt iTCO_vendor_support mei_wdt gpio_ich
snd_seq
 snd_seq_device snd_pcm snd_timer snd soundcore tpm_infineon mei_me
mei acpi_cpufreq tpm_tis parport_pc parport i2c_i801 tpm_tis_core
shpchp tpm lpc_ich nfsd auth_rpcgss nfs_acl lockd grace sunrpc
binfmt_misc btrfs hid_logitech_hidpp xor i915 raid6_pq crc32c_intel
video i2c_algo_bit drm_kms_helper serio_raw drm hid_logitech_dj uas
usb_storage r8169 mii
CPU: 0 PID: 14133 Comm: btrfs Tainted: G        W
4.11.3-200.local.btrfs_patched.fc25.x86_64 #1
Hardware name: MSI MS-7636/H55M-P31(MS-7636)   , BIOS V1.9 09/14/2010
Call Trace:
 dump_stack+0x63/0x86
 __warn+0xcb/0xf0
 warn_slowpath_fmt+0x5a/0x80
 btrfs_get_extent_inline_ref_type+0xcb/0xe0 [btrfs]
 scrub_stripe+0x733/0x1170 [btrfs]
 scrub_chunk+0x102/0x140 [btrfs]
 ? scrub_chunk+0x102/0x140 [btrfs]
 scrub_enumerate_chunks+0x300/0x680 [btrfs]
 ? wake_atomic_t_function+0x60/0x70
 btrfs_scrub_dev+0x213/0x540 [btrfs]
 ? __mnt_want_write+0x56/0x60
 btrfs_ioctl+0x1351/0x2470 [btrfs]
 do_vfs_ioctl+0xa3/0x5f0
 ? do_vfs_ioctl+0xa3/0x5f0
 ? security_file_ioctl+0x43/0x60
 SyS_ioctl+0x79/0x90
 do_syscall_64+0x67/0x180
 entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7fa688cc4787
RSP: 002b:00007fa6873c2d58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00005572d3db7190 RCX: 00007fa688cc4787
RDX: 00005572d3db7190 RSI: 00000000c400941b RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fa6873c3700 R09: 0000000000000000
R10: 00007fa6873c3700 R11: 0000000000000246 R12: 00007fa6873c3500
R13: 00007ffc22fb28ef R14: 00007fa6873c39c0 R15: 00007fa6873c3700
---[ end trace 70deff6b302d4409 ]---
BTRFS error (device sdb1): scrub: extent 2994741510144(0x2b944810000)
has an invalid extent inline ref type, ignored.
BTRFS info (device sdb1): leaf 2994891669504 total ptrs 121 free space 8284
        item 0 key (2994739920896 169 0) itemoff 16250 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278117376
        item 1 key (2994739937280 169 0) itemoff 16217 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 2 key (2994739953664 169 0) itemoff 16184 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 3 key (2994739970048 169 0) itemoff 16151 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 4 key (2994739986432 169 0) itemoff 16118 itemsize 33
                extent refs 1 gen 826970 flags 2
                tree block backref root 7
        item 5 key (2994740002816 169 0) itemoff 16085 itemsize 33
                extent refs 1 gen 983344 flags 2
                tree block backref root 7
        item 6 key (2994740019200 169 0) itemoff 16052 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 7 key (2994740035584 169 0) itemoff 16019 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 8 key (2994740051968 169 0) itemoff 15986 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 9 key (2994740068352 169 0) itemoff 15953 itemsize 33
                extent refs 1 gen 826970 flags 2
                tree block backref root 7
        item 10 key (2994740084736 169 0) itemoff 15920 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 11 key (2994740101120 169 0) itemoff 15887 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 12 key (2994740117504 169 0) itemoff 15854 itemsize 33
                extent refs 1 gen 1414389 flags 258
                shared block backref parent 4632584617984
        item 13 key (2994740133888 169 0) itemoff 15821 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 14 key (2994740150272 169 0) itemoff 15788 itemsize 33
                extent refs 1 gen 826970 flags 2
                tree block backref root 7
        item 15 key (2994740166656 169 0) itemoff 15755 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 16 key (2994740183040 169 0) itemoff 15722 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 17 key (2994740199424 169 0) itemoff 15689 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 18 key (2994740215808 169 0) itemoff 15647 itemsize 42
                extent refs 2 gen 1406394 flags 258
                shared block backref parent 4633401622528
                shared block backref parent 4627188744192
        item 19 key (2994740232192 169 0) itemoff 15614 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278150144
        item 20 key (2994740248576 169 0) itemoff 15581 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 21 key (2994740264960 169 0) itemoff 15548 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 22 key (2994740281344 169 0) itemoff 15515 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 23 key (2994740297728 169 0) itemoff 15482 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 24 key (2994740314112 169 0) itemoff 15440 itemsize 42
                extent refs 2 gen 1406394 flags 258
                shared block backref parent 4633401622528
                shared block backref parent 4627188744192
        item 25 key (2994740330496 169 0) itemoff 15407 itemsize 33
                extent refs 1 gen 827339 flags 258
                shared block backref parent 4037502517248
        item 26 key (2994740346880 169 0) itemoff 15374 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 27 key (2994740363264 169 0) itemoff 15332 itemsize 42
                extent refs 2 gen 1322391 flags 258
                shared block backref parent 4537765806080
                shared block backref parent 4537190842368
        item 28 key (2994740379648 169 0) itemoff 15290 itemsize 42
                extent refs 2 gen 1406394 flags 258
                shared block backref parent 4633401622528
                shared block backref parent 4627188744192
        item 29 key (2994740396032 169 0) itemoff 15230 itemsize 60
                extent refs 4 gen 826464 flags 258
                shared block backref parent 4037394251776
                shared block backref parent 4037222711296
                shared block backref parent 3213570605056
                shared block backref parent 3213569130496
        item 30 key (2994740412416 169 0) itemoff 15179 itemsize 51
                extent refs 3 gen 827339 flags 258
                shared block backref parent 3470248460288
                shared block backref parent 3470248443904
                shared block backref parent 3470248329216
        item 31 key (2994740428800 169 0) itemoff 15146 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 32 key (2994740461568 169 0) itemoff 15113 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 33 key (2994740477952 169 0) itemoff 15080 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 34 key (2994740510720 169 0) itemoff 15038 itemsize 42
                extent refs 2 gen 1414985 flags 2
                tree block backref root 23268
                shared block backref parent 4633738919936
        item 35 key (2994740527104 169 0) itemoff 15005 itemsize 33
                extent refs 1 gen 1262619 flags 258
                shared block backref parent 2994735022080
        item 36 key (2994740543488 169 0) itemoff 14972 itemsize 33
                extent refs 1 gen 1414571 flags 2
                tree block backref root 23268
        item 37 key (2994740559872 169 0) itemoff 14939 itemsize 33
                extent refs 1 gen 1414571 flags 2
                tree block backref root 23269
        item 38 key (2994740576256 169 0) itemoff 14870 itemsize 69
                extent refs 5 gen 1417199 flags 2
                tree block backref root 23268
                shared block backref parent 4634987790336
                shared block backref parent 4630838362112
                shared block backref parent 4630064791552
                shared block backref parent 4628769914880
        item 39 key (2994740592640 169 0) itemoff 14828 itemsize 42
                extent refs 2 gen 827339 flags 258
                shared block backref parent 4197157306368
                shared block backref parent 4197157257216
        item 40 key (2994740609024 169 0) itemoff 14795 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278117376
        item 41 key (2994740625408 169 0) itemoff 14717 itemsize 78
                extent refs 6 gen 831506 flags 258
                shared block backref parent 4240500473856
                shared block backref parent 4239944220672
                shared block backref parent 4197485166592
                shared block backref parent 4197485150208
                shared block backref parent 4197467586560
                shared block backref parent 4001359904768
        item 42 key (2994740641792 169 0) itemoff 14684 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278150144
        item 43 key (2994740674560 169 0) itemoff 14651 itemsize 33
                extent refs 1 gen 1264652 flags 258
                shared block backref parent 4196919754752
        item 44 key (2994740690944 169 0) itemoff 14591 itemsize 60
                extent refs 4 gen 827339 flags 258
                shared block backref parent 4240327262208
                shared block backref parent 4240083386368
                shared block backref parent 4197838585856
                shared block backref parent 4026387365888
        item 45 key (2994740707328 169 0) itemoff 14558 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 46 key (2994740723712 169 0) itemoff 14525 itemsize 33
                extent refs 1 gen 1400556 flags 258
                shared block backref parent 4636817702912
        item 47 key (2994740740096 169 0) itemoff 14492 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278117376
        item 48 key (2994740756480 169 0) itemoff 14459 itemsize 33
                extent refs 1 gen 1262619 flags 258
                shared block backref parent 4197476712448
        item 49 key (2994740772864 169 0) itemoff 14165 itemsize 294
                extent refs 30 gen 826464 flags 258
                tree block backref root 23269
                tree block backref root 22154
                tree block backref root 599
                shared block backref parent 4851402244096
                shared block backref parent 4635304804352
                shared block backref parent 4628579106816
                shared block backref parent 4628285816832
                shared block backref parent 4627642433536
                shared block backref parent 4537789579264
                shared block backref parent 4537419677696
                shared block backref parent 4537241993216
                shared block backref parent 4240853876736
                shared block backref parent 4240792502272
                shared block backref parent 4240286760960
                shared block backref parent 4197594628096
                shared block backref parent 4197489754112
                shared block backref parent 4197489377280
                shared block backref parent 4197489328128
                shared block backref parent 4197476712448
                shared block backref parent 4197107908608
                shared block backref parent 4001305739264
                shared block backref parent 4000873627648
                shared block backref parent 3918606139392
                shared block backref parent 3470774747136
                shared block backref parent 3213987184640
                shared block backref parent 3213552025600
                shared block backref parent 3213531414528
                shared block backref parent 2994976833536
                shared block backref parent 2994213994496
                shared block backref parent 2405100175360
        item 50 key (2994740789248 169 0) itemoff 13952 itemsize 213
                extent refs 21 gen 827339 flags 258
                tree block backref root 22154
                tree block backref root 599
                shared block backref parent 4627601620992
                shared block backref parent 4537810042880
                shared block backref parent 4537500680192
                shared block backref parent 4537357205504
                shared block backref parent 4537200869376
                shared block backref parent 4240320200704
                shared block backref parent 4240180199424
                shared block backref parent 4197591351296
                shared block backref parent 4197591269376
                shared block backref parent 4197324750848
                shared block backref parent 4196935434240
                shared block backref parent 4037456265216
                shared block backref parent 4027117404160
                shared block backref parent 3379070582784
                shared block backref parent 2993861459968
                shared block backref parent 2993423548416
                shared block backref parent 2941186490368
                shared block backref parent 2405627346944
                shared block backref parent 2405178884096
        item 51 key (2994740805632 169 0) itemoff 13919 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278150144
        item 52 key (2994740822016 169 0) itemoff 13886 itemsize 33
                extent refs 1 gen 832548 flags 2
                tree block backref root 7
        item 53 key (2994740838400 169 0) itemoff 13844 itemsize 42
                extent refs 2 gen 827339 flags 258
                shared block backref parent 4037502517248
                shared block backref parent 3918522187776
        item 54 key (2994740854784 169 0) itemoff 13811 itemsize 33
                extent refs 1 gen 1414662 flags 2
                tree block backref root 23268
        item 55 key (2994740887552 169 0) itemoff 13778 itemsize 33
                extent refs 1 gen 832548 flags 2
                tree block backref root 7
        item 56 key (2994740903936 169 0) itemoff 13736 itemsize 42
                extent refs 2 gen 827339 flags 258
                shared block backref parent 4037502517248
                shared block backref parent 3918522187776
        item 57 key (2994740920320 169 0) itemoff 13703 itemsize 33
                extent refs 1 gen 828860 flags 258
                shared block backref parent 4026247200768
        item 58 key (2994740936704 169 0) itemoff 13670 itemsize 33
                extent refs 1 gen 832548 flags 2
                tree block backref root 7
        item 59 key (2994740953088 169 0) itemoff 13628 itemsize 42
                extent refs 2 gen 1381556 flags 258
                shared block backref parent 3213982466048
                shared block backref parent 2994764578816
        item 60 key (2994740969472 169 0) itemoff 13595 itemsize 33
                extent refs 1 gen 1388773 flags 258
                shared block backref parent 4629308555264
        item 61 key (2994741002240 169 0) itemoff 13562 itemsize 33
                extent refs 1 gen 833647 flags 2
                tree block backref root 7
        item 62 key (2994741018624 169 0) itemoff 13529 itemsize 33
                extent refs 1 gen 828860 flags 258
                shared block backref parent 4026355630080
        item 63 key (2994741035008 169 0) itemoff 13460 itemsize 69
                extent refs 5 gen 1417199 flags 2
                tree block backref root 23268
                shared block backref parent 4634987790336
                shared block backref parent 4630838362112
                shared block backref parent 4630064791552
                shared block backref parent 4628769914880
        item 64 key (2994741051392 169 0) itemoff 13427 itemsize 33
                extent refs 1 gen 1417199 flags 2
                tree block backref root 2
        item 65 key (2994741067776 169 0) itemoff 13394 itemsize 33
                extent refs 1 gen 1414571 flags 2
                tree block backref root 23268
        item 66 key (2994741084160 169 0) itemoff 13343 itemsize 51
                extent refs 3 gen 1414985 flags 2
                tree block backref root 23268
                shared block backref parent 4850632065024
                shared block backref parent 4630524002304
        item 67 key (2994741100544 169 0) itemoff 13310 itemsize 33
                extent refs 1 gen 1401319 flags 258
                shared block backref parent 2404955914240
        item 68 key (2994741116928 169 0) itemoff 13277 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278117376
        item 69 key (2994741133312 169 0) itemoff 13244 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 70 key (2994741149696 169 0) itemoff 13211 itemsize 33
                extent refs 1 gen 833513 flags 258
                shared block backref parent 4026278150144
        item 71 key (2994741182464 169 0) itemoff 13178 itemsize 33
                extent refs 1 gen 1400556 flags 258
                shared block backref parent 4636825878528
        item 72 key (2994741198848 169 0) itemoff 13145 itemsize 33
                extent refs 1 gen 1372535 flags 2
                tree block backref root 1577
        item 73 key (2994741215232 169 0) itemoff 13112 itemsize 33
                extent refs 1 gen 1417199 flags 2
                tree block backref root 2
        item 74 key (2994741231616 169 0) itemoff 13079 itemsize 33
                extent refs 1 gen 1400556 flags 258
                shared block backref parent 4636824109056
        item 75 key (2994741248000 169 0) itemoff 13046 itemsize 33
                extent refs 1 gen 1263596 flags 258
                shared block backref parent 4196936613888
        item 76 key (2994741264384 169 0) itemoff 13013 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 77 key (2994741280768 169 0) itemoff 12980 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 78 key (2994741297152 169 0) itemoff 12947 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 79 key (2994741313536 169 0) itemoff 12914 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 80 key (2994741329920 169 0) itemoff 12746 itemsize 168
                extent refs 16 gen 827339 flags 258
                tree block backref root 600
                shared block backref parent 4628782678016
                shared block backref parent 4537392381952
                shared block backref parent 4537253691392
                shared block backref parent 4197723029504
                shared block backref parent 4197274419200
                shared block backref parent 4197047074816
                shared block backref parent 4037851742208
                shared block backref parent 4000956743680
                shared block backref parent 4000687423488
                shared block backref parent 4000453361664
                shared block backref parent 3918531346432
                shared block backref parent 3918469185536
                shared block backref parent 3213947092992
                shared block backref parent 2993295720448
                shared block backref parent 2477789478912
        item 81 key (2994741346304 169 0) itemoff 12713 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 82 key (2994741362688 169 0) itemoff 12680 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 83 key (2994741379072 169 0) itemoff 12647 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 84 key (2994741395456 169 0) itemoff 12614 itemsize 33
                extent refs 1 gen 1389683 flags 2
                tree block backref root 3095
        item 85 key (2994741411840 169 0) itemoff 12581 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 86 key (2994741428224 169 0) itemoff 12548 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 87 key (2994741444608 169 0) itemoff 12515 itemsize 33
                extent refs 1 gen 1401319 flags 258
                shared block backref parent 2404955914240
        item 88 key (2994741460992 169 0) itemoff 12482 itemsize 33
                extent refs 1 gen 1417250 flags 2
                tree block backref root 1451
        item 89 key (2994741477376 169 0) itemoff 12404 itemsize 78
                extent refs 6 gen 827339 flags 258
                shared block backref parent 4197954289664
                shared block backref parent 4197954256896
                shared block backref parent 4197577523200
                shared block backref parent 4197571641344
                shared block backref parent 4000654016512
                shared block backref parent 3917758775296
        item 90 key (2994741493760 169 0) itemoff 12371 itemsize 33
                extent refs 811139072 gen 246284288 flags 0
                tree block backref root 1429
        item 91 key (2994741510144 169 0) itemoff 12338 itemsize 33
                extent refs 0 gen 0 flags 0
BTRFS error (device sdb1): extent 2994891669504 has invalid ref type 0
        item 92 key (2994741559296 169 0) itemoff 12305 itemsize 33
                extent refs 1 gen 1389525 flags 1578675552460472322
BTRFS error (device sdb1): extent 2994891669504 has invalid ref type 0
        item 93 key (2994741575680 169 0) itemoff 12272 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 94 key (2994741592064 169 0) itemoff 12230 itemsize 42
                extent refs 2 gen 1414178 flags 258
                shared block backref parent 2995019202560
                shared block backref parent 2993213603840
        item 95 key (2994741608448 169 0) itemoff 12197 itemsize 33
                extent refs 1 gen 1322391 flags 258
                shared block backref parent 2404909006848
        item 96 key (2994741624832 169 0) itemoff 12164 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 97 key (2994741641216 169 0) itemoff 12131 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 98 key (2994741657600 169 0) itemoff 12089 itemsize 42
                extent refs 2 gen 1417199 flags 2
                tree block backref root 23268
                shared block backref parent 5168957800448
        item 99 key (2994741673984 169 0) itemoff 12056 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 100 key (2994741690368 169 0) itemoff 12014 itemsize 42
                extent refs 2 gen 1322391 flags 258
                shared block backref parent 4537776128000
                shared block backref parent 4537233702912
        item 101 key (2994741706752 169 0) itemoff 11972 itemsize 42
                extent refs 2 gen 1417199 flags 2
                tree block backref root 23268
                shared block backref parent 5168957800448
        item 102 key (2994741723136 169 0) itemoff 11939 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 103 key (2994741739520 169 0) itemoff 11906 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 104 key (2994741755904 169 0) itemoff 11873 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 105 key (2994741772288 169 0) itemoff 11840 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 106 key (2994741788672 169 0) itemoff 11798 itemsize 42
                extent refs 2 gen 1374196 flags 258
                tree block backref root 23480
                shared block backref parent 2405081251840
        item 107 key (2994741805056 169 0) itemoff 11765 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 108 key (2994741821440 169 0) itemoff 11723 itemsize 42
                extent refs 2 gen 1414985 flags 2
                tree block backref root 23268
                shared block backref parent 4850630082560
        item 109 key (2994741837824 169 0) itemoff 11690 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 110 key (2994741854208 169 0) itemoff 11648 itemsize 42
                extent refs 2 gen 1374196 flags 258
                tree block backref root 23480
                shared block backref parent 2405081251840
        item 111 key (2994741870592 169 0) itemoff 11615 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 112 key (2994741886976 169 0) itemoff 11573 itemsize 42
                extent refs 2 gen 1417199 flags 2
                tree block backref root 23268
                shared block backref parent 5168957800448
        item 113 key (2994741903360 169 0) itemoff 11540 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 114 key (2994741919744 169 0) itemoff 11507 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
        item 115 key (2994741936128 169 0) itemoff 11474 itemsize 33
                extent refs 1 gen 1401319 flags 258
                shared block backref parent 2404955914240
        item 116 key (2994741952512 169 0) itemoff 11441 itemsize 33
                extent refs 1 gen 1401319 flags 258
                shared block backref parent 2404955914240
        item 117 key (2994741968896 169 0) itemoff 11408 itemsize 33
                extent refs 1 gen 1389730 flags 2
                tree block backref root 1429
        item 118 key (2994741985280 169 0) itemoff 11375 itemsize 33
                extent refs 1 gen 1414514 flags 2
                tree block backref root 23268
        item 119 key (2994742001664 169 0) itemoff 11342 itemsize 33
                extent refs 1 gen 827339 flags 258
                shared block backref parent 4037910560768
        item 120 key (2994742018048 169 0) itemoff 11309 itemsize 33
                extent refs 1 gen 1389525 flags 2
                tree block backref root 2069
------------[ cut here ]------------
WARNING: CPU: 0 PID: 14133 at fs/btrfs/extent-tree.c:1150
btrfs_get_extent_inline_ref_type+0xcb/0xe0 [btrfs]
eb 2994891669504(tree block) invalid extent inline ref type 0
Modules linked in: veth xt_nat ipt_MASQUERADE nf_nat_masquerade_ipv4
xt_addrtype br_netfilter nf_conntrack_netbios_ns
nf_conntrack_broadcast nf_conntrack_ftp xt_CT ip6t_rpfilter
ip6t_REJECT nf_reject_ipv6 ip_set nfnetlink ebtable_nat ebtable_broute
bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat
nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security
ebtable_filter ebtables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack
nf_conntrack libcrc32c ip6table_filter ip6_tables intel_powerclamp
coretemp kvm_intel kvm snd_hda_codec_realtek snd_hda_codec_generic
irqbypass snd_hda_intel intel_cstate snd_hda_codec intel_uncore ppdev
snd_hda_core snd_hwdep iTCO_wdt iTCO_vendor_support mei_wdt gpio_ich
snd_seq
 snd_seq_device snd_pcm snd_timer snd soundcore tpm_infineon mei_me
mei acpi_cpufreq tpm_tis parport_pc parport i2c_i801 tpm_tis_core
shpchp tpm lpc_ich nfsd auth_rpcgss nfs_acl lockd grace sunrpc
binfmt_misc btrfs hid_logitech_hidpp xor i915 raid6_pq crc32c_intel
video i2c_algo_bit drm_kms_helper serio_raw drm hid_logitech_dj uas
usb_storage r8169 mii
CPU: 0 PID: 14133 Comm: btrfs Tainted: G        W
4.11.3-200.local.btrfs_patched.fc25.x86_64 #1
Hardware name: MSI MS-7636/H55M-P31(MS-7636)   , BIOS V1.9 09/14/2010
Call Trace:
 dump_stack+0x63/0x86
 __warn+0xcb/0xf0
 warn_slowpath_fmt+0x5a/0x80
 btrfs_get_extent_inline_ref_type+0xcb/0xe0 [btrfs]
 scrub_stripe+0x733/0x1170 [btrfs]
 scrub_chunk+0x102/0x140 [btrfs]
 ? scrub_chunk+0x102/0x140 [btrfs]
 scrub_enumerate_chunks+0x300/0x680 [btrfs]
 ? wake_atomic_t_function+0x60/0x70
 btrfs_scrub_dev+0x213/0x540 [btrfs]
 ? __mnt_want_write+0x56/0x60
 btrfs_ioctl+0x1351/0x2470 [btrfs]
 do_vfs_ioctl+0xa3/0x5f0
 ? do_vfs_ioctl+0xa3/0x5f0
 ? security_file_ioctl+0x43/0x60
 SyS_ioctl+0x79/0x90
 do_syscall_64+0x67/0x180
 entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7fa688cc4787
RSP: 002b:00007fa6873c2d58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00005572d3db7190 RCX: 00007fa688cc4787
RDX: 00005572d3db7190 RSI: 00000000c400941b RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fa6873c3700 R09: 0000000000000000
R10: 00007fa6873c3700 R11: 0000000000000246 R12: 00007fa6873c3500
R13: 00007ffc22fb28ef R14: 00007fa6873c39c0 R15: 00007fa6873c3700
---[ end trace 70deff6b302d440a ]---
BTRFS error (device sdb1): scrub: extent 2994741559296(0x2b94481c000)
has an invalid extent inline ref type, ignored.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 18938 at fs/btrfs/scrub.c:1804
scrub_bio_end_io_worker+0x32c/0x4e0 [btrfs]
Modules linked in: veth xt_nat ipt_MASQUERADE nf_nat_masquerade_ipv4
xt_addrtype br_netfilter nf_conntrack_netbios_ns
nf_conntrack_broadcast nf_conntrack_ftp xt_CT ip6t_rpfilter
ip6t_REJECT nf_reject_ipv6 ip_set nfnetlink ebtable_nat ebtable_broute
bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat
nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security
ebtable_filter ebtables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack
nf_conntrack libcrc32c ip6table_filter ip6_tables intel_powerclamp
coretemp kvm_intel kvm snd_hda_codec_realtek snd_hda_codec_generic
irqbypass snd_hda_intel intel_cstate snd_hda_codec intel_uncore ppdev
snd_hda_core snd_hwdep iTCO_wdt iTCO_vendor_support mei_wdt gpio_ich
snd_seq
 snd_seq_device snd_pcm snd_timer snd soundcore tpm_infineon mei_me
mei acpi_cpufreq tpm_tis parport_pc parport i2c_i801 tpm_tis_core
shpchp tpm lpc_ich nfsd auth_rpcgss nfs_acl lockd grace sunrpc
binfmt_misc btrfs hid_logitech_hidpp xor i915 raid6_pq crc32c_intel
video i2c_algo_bit drm_kms_helper serio_raw drm hid_logitech_dj uas
usb_storage r8169 mii
CPU: 0 PID: 18938 Comm: kworker/u16:3 Tainted: G        W
4.11.3-200.local.btrfs_patched.fc25.x86_64 #1
Hardware name: MSI MS-7636/H55M-P31(MS-7636)   , BIOS V1.9 09/14/2010
Workqueue: btrfs-scrub btrfs_scrub_helper [btrfs]
Call Trace:
 dump_stack+0x63/0x86
 __warn+0xcb/0xf0
 warn_slowpath_null+0x1d/0x20
 scrub_bio_end_io_worker+0x32c/0x4e0 [btrfs]
 ? set_next_entity+0xd9/0x220
 ? pick_next_task_fair+0x4dc/0x550
 ? __switch_to+0x227/0x460
 btrfs_scrubparity_helper+0xc0/0x2f0 [btrfs]
 btrfs_scrub_helper+0xe/0x10 [btrfs]
 process_one_work+0x197/0x450
 worker_thread+0x4e/0x4a0
 kthread+0x109/0x140
 ? process_one_work+0x450/0x450
 ? kthread_park+0x90/0x90
 ? do_syscall_64+0x67/0x180
 ret_from_fork+0x2c/0x40
---[ end trace 70deff6b302d440b ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 18938 at fs/btrfs/scrub.c:1804
scrub_bio_end_io_worker+0x32c/0x4e0 [btrfs]
Modules linked in: veth xt_nat ipt_MASQUERADE nf_nat_masquerade_ipv4
xt_addrtype br_netfilter nf_conntrack_netbios_ns
nf_conntrack_broadcast nf_conntrack_ftp xt_CT ip6t_rpfilter
ip6t_REJECT nf_reject_ipv6 ip_set nfnetlink ebtable_nat ebtable_broute
bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat
nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security
ebtable_filter ebtables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack
nf_conntrack libcrc32c ip6table_filter ip6_tables intel_powerclamp
coretemp kvm_intel kvm snd_hda_codec_realtek snd_hda_codec_generic
irqbypass snd_hda_intel intel_cstate snd_hda_codec intel_uncore ppdev
snd_hda_core snd_hwdep iTCO_wdt iTCO_vendor_support mei_wdt gpio_ich
snd_seq
 snd_seq_device snd_pcm snd_timer snd soundcore tpm_infineon mei_me
mei acpi_cpufreq tpm_tis parport_pc parport i2c_i801 tpm_tis_core
shpchp tpm lpc_ich nfsd auth_rpcgss nfs_acl lockd grace sunrpc
binfmt_misc btrfs hid_logitech_hidpp xor i915 raid6_pq crc32c_intel
video i2c_algo_bit drm_kms_helper serio_raw drm hid_logitech_dj uas
usb_storage r8169 mii
CPU: 0 PID: 18938 Comm: kworker/u16:3 Tainted: G        W
4.11.3-200.local.btrfs_patched.fc25.x86_64 #1
Hardware name: MSI MS-7636/H55M-P31(MS-7636)   , BIOS V1.9 09/14/2010
Workqueue: btrfs-scrub btrfs_scrub_helper [btrfs]
Call Trace:
 dump_stack+0x63/0x86
 __warn+0xcb/0xf0
 warn_slowpath_null+0x1d/0x20
 scrub_bio_end_io_worker+0x32c/0x4e0 [btrfs]
 ? set_next_entity+0xd9/0x220
 ? pick_next_task_fair+0x4dc/0x550
 ? __switch_to+0x227/0x460
 btrfs_scrubparity_helper+0xc0/0x2f0 [btrfs]
 btrfs_scrub_helper+0xe/0x10 [btrfs]
 process_one_work+0x197/0x450
 worker_thread+0x4e/0x4a0
 kthread+0x109/0x140
 ? process_one_work+0x450/0x450
 ? kthread_park+0x90/0x90
 ? do_syscall_64+0x67/0x180
 ret_from_fork+0x2c/0x40
---[ end trace 70deff6b302d440c ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 18938 at fs/btrfs/scrub.c:1804
scrub_bio_end_io_worker+0x32c/0x4e0 [btrfs]
Modules linked in: veth xt_nat ipt_MASQUERADE nf_nat_masquerade_ipv4
xt_addrtype br_netfilter nf_conntrack_netbios_ns
nf_conntrack_broadcast nf_conntrack_ftp xt_CT ip6t_rpfilter
ip6t_REJECT nf_reject_ipv6 ip_set nfnetlink ebtable_nat ebtable_broute
bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat
nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security
ebtable_filter ebtables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack
nf_conntrack libcrc32c ip6table_filter ip6_tables intel_powerclamp
coretemp kvm_intel kvm snd_hda_codec_realtek snd_hda_codec_generic
irqbypass snd_hda_intel intel_cstate snd_hda_codec intel_uncore ppdev
snd_hda_core snd_hwdep iTCO_wdt iTCO_vendor_support mei_wdt gpio_ich
snd_seq
 snd_seq_device snd_pcm snd_timer snd soundcore tpm_infineon mei_me
mei acpi_cpufreq tpm_tis parport_pc parport i2c_i801 tpm_tis_core
shpchp tpm lpc_ich nfsd auth_rpcgss nfs_acl lockd grace sunrpc
binfmt_misc btrfs hid_logitech_hidpp xor i915 raid6_pq crc32c_intel
video i2c_algo_bit drm_kms_helper serio_raw drm hid_logitech_dj uas
usb_storage r8169 mii
CPU: 0 PID: 18938 Comm: kworker/u16:3 Tainted: G        W
4.11.3-200.local.btrfs_patched.fc25.x86_64 #1
Hardware name: MSI MS-7636/H55M-P31(MS-7636)   , BIOS V1.9 09/14/2010
Workqueue: btrfs-scrub btrfs_scrub_helper [btrfs]
Call Trace:
 dump_stack+0x63/0x86
 __warn+0xcb/0xf0
 warn_slowpath_null+0x1d/0x20
 scrub_bio_end_io_worker+0x32c/0x4e0 [btrfs]
 ? set_next_entity+0xd9/0x220
 ? pick_next_task_fair+0x4dc/0x550
 ? __switch_to+0x227/0x460
 btrfs_scrubparity_helper+0xc0/0x2f0 [btrfs]
 btrfs_scrub_helper+0xe/0x10 [btrfs]
 process_one_work+0x197/0x450
 worker_thread+0x4e/0x4a0
 kthread+0x109/0x140
 ? process_one_work+0x450/0x450
 ? kthread_park+0x90/0x90
 ? do_syscall_64+0x67/0x180
 ret_from_fork+0x2c/0x40
---[ end trace 70deff6b302d440d ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 18938 at fs/btrfs/scrub.c:1804
scrub_bio_end_io_worker+0x32c/0x4e0 [btrfs]
Modules linked in: veth xt_nat ipt_MASQUERADE nf_nat_masquerade_ipv4
xt_addrtype br_netfilter nf_conntrack_netbios_ns
nf_conntrack_broadcast nf_conntrack_ftp xt_CT ip6t_rpfilter
ip6t_REJECT nf_reject_ipv6 ip_set nfnetlink ebtable_nat ebtable_broute
bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat
nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security
ebtable_filter ebtables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack
nf_conntrack libcrc32c ip6table_filter ip6_tables intel_powerclamp
coretemp kvm_intel kvm snd_hda_codec_realtek snd_hda_codec_generic
irqbypass snd_hda_intel intel_cstate snd_hda_codec intel_uncore ppdev
snd_hda_core snd_hwdep iTCO_wdt iTCO_vendor_support mei_wdt gpio_ich
snd_seq
 snd_seq_device snd_pcm snd_timer snd soundcore tpm_infineon mei_me
mei acpi_cpufreq tpm_tis parport_pc parport i2c_i801 tpm_tis_core
shpchp tpm lpc_ich nfsd auth_rpcgss nfs_acl lockd grace sunrpc
binfmt_misc btrfs hid_logitech_hidpp xor i915 raid6_pq crc32c_intel
video i2c_algo_bit drm_kms_helper serio_raw drm hid_logitech_dj uas
usb_storage r8169 mii
CPU: 0 PID: 18938 Comm: kworker/u16:3 Tainted: G        W
4.11.3-200.local.btrfs_patched.fc25.x86_64 #1
Hardware name: MSI MS-7636/H55M-P31(MS-7636)   , BIOS V1.9 09/14/2010
Workqueue: btrfs-scrub btrfs_scrub_helper [btrfs]
Call Trace:
 dump_stack+0x63/0x86
 __warn+0xcb/0xf0
 warn_slowpath_null+0x1d/0x20
 scrub_bio_end_io_worker+0x32c/0x4e0 [btrfs]
 ? set_next_entity+0xd9/0x220
 ? pick_next_task_fair+0x4dc/0x550
 ? __switch_to+0x227/0x460
 btrfs_scrubparity_helper+0xc0/0x2f0 [btrfs]
 btrfs_scrub_helper+0xe/0x10 [btrfs]
 process_one_work+0x197/0x450
 worker_thread+0x4e/0x4a0
 kthread+0x109/0x140
 ? process_one_work+0x450/0x450
 ? kthread_park+0x90/0x90
 ? do_syscall_64+0x67/0x180
 ret_from_fork+0x2c/0x40
---[ end trace 70deff6b302d440e ]---

-- 
Ivan Sizov

Re: [PATCH 0/6] add sanity check for extent inline ref type

[Liu Bo]

On Tue, May 30, 2017 at 05:05:09PM +0300, Ivan Sizov wrote:
> 2017-05-26 3:26 GMT+03:00 Liu Bo <bo.li.liu@oracle.com>:
> >Patch 6 adds scrub support to detect the corruption, so users can be
> noticed when they do scrub on a regular basis.
> >I'm not sure in the real world what may result in this corruption
> 
> I've caught this type of corruption in the wild. The big rsync backup
> always ends with a kernel crash due to BUG() statement in
> ctime.h:1779. After applying this patchset and running scrub I've got
> following messages:
> 
> [sivan@fruestuck ~]$ dmesg | grep "invalid extent inline"
> [ 8812.428673] eb 4631634034688(tree block) invalid extent inline ref type 0
> [ 8812.429148] BTRFS error (device sdb1): scrub: extent
> 2994741510144(0x2b944810000) has an invalid extent inline ref type,
> ignored.
> [ 8812.430086] eb 4631634034688(tree block) invalid extent inline ref type 0
> [ 8812.430569] BTRFS error (device sdb1): scrub: extent
> 2994741559296(0x2b94481c000) has an invalid extent inline ref type,
> ignored.
> 
> How to find the cause of the corruption? Should I try to fix it, or it
> is not dangerous for the filesystem? If I should, how to do that?

After I went through the output of leaf's content, most parts of the
leaf is sane except the two corrupted items, it's still not clear to
me what caused the corruption, there could be some corner cases that
I'm not aware of.

If fsck doesn't work for you, then a recovery from backup may be the
best option.

Thanks,

-liubo

Re: [PATCH 0/6] add sanity check for extent inline ref type

[Ivan Sizov]

2017-06-01 20:35 GMT+03:00 Liu Bo <bo.li.liu@oracle.com>:
> After I went through the output of leaf's content, most parts of the
> leaf is sane except the two corrupted items, it's still not clear to
> me what caused the corruption, there could be some corner cases that
> I'm not aware of.
>
> If fsck doesn't work for you, then a recovery from backup may be the
> best option.

I don't need to run any repair procedures because system is working
normally. Most likely that corrupted extents belong to files located
somewhere in /home.
Do you mean I should run fsck in order to determine which files are
corrupted? What are proper options to run fsck with?

-- 
Ivan Sizov

Re: [PATCH 0/6] add sanity check for extent inline ref type

[Liu Bo]

On Thu, Jun 01, 2017 at 11:26:26PM +0300, Ivan Sizov wrote:
> 2017-06-01 20:35 GMT+03:00 Liu Bo <bo.li.liu@oracle.com>:
> > After I went through the output of leaf's content, most parts of the
> > leaf is sane except the two corrupted items, it's still not clear to
> > me what caused the corruption, there could be some corner cases that
> > I'm not aware of.
> >
> > If fsck doesn't work for you, then a recovery from backup may be the
> > best option.
> 
> I don't need to run any repair procedures because system is working
> normally. Most likely that corrupted extents belong to files located
> somewhere in /home.
> Do you mean I should run fsck in order to determine which files are
> corrupted? What are proper options to run fsck with?

I see.  Scrub has found that there are some corrupted metadata, if you
want to fix that corrupted thing, fsck may be helpful.  Due to my
test, 'btrfs check /your_disk' fixed my corruption.

With this patch set, at least you won't get a crash when accessing the
corrupted extent inline ref.

-liubo

Re: [PATCH 0/6] add sanity check for extent inline ref type

[Ivan Sizov]

2017-06-02 1:57 GMT+03:00 Liu Bo <bo.li.liu@oracle.com>:
> On Thu, Jun 01, 2017 at 11:26:26PM +0300, Ivan Sizov wrote:
>> 2017-06-01 20:35 GMT+03:00 Liu Bo <bo.li.liu@oracle.com>:
>> > After I went through the output of leaf's content, most parts of the
>> > leaf is sane except the two corrupted items, it's still not clear to
>> > me what caused the corruption, there could be some corner cases that
>> > I'm not aware of.
>> >
>> > If fsck doesn't work for you, then a recovery from backup may be the
>> > best option.
>>
>> I don't need to run any repair procedures because system is working
>> normally. Most likely that corrupted extents belong to files located
>> somewhere in /home.
>> Do you mean I should run fsck in order to determine which files are
>> corrupted? What are proper options to run fsck with?
>
> I see.  Scrub has found that there are some corrupted metadata, if you
> want to fix that corrupted thing, fsck may be helpful.  Due to my
> test, 'btrfs check /your_disk' fixed my corruption.
>
> With this patch set, at least you won't get a crash when accessing the
> corrupted extent inline ref.
>
> -liubo

After applying patchset I unwisely ran rsync and then FS became RW-unmountable.
"btrfs-check -p --readonly" gave me many errors of different types.
After "btrfs check -p --repair" I'd mounted the FS and ran scrub.
But not all errors was fixed and boot attempt caused RO-remounting again.

Now check gives this:

[liveuser@localhost-live ~]$ sudo btrfs check -p --readonly /dev/sda1
Checking filesystem on /dev/sda1
UUID: 4b30bf4a-2331-40fb-a108-e1a34aa14221
ref mismatch on [2398147911680 4096] extent item 12, found 13
Backref 2398147911680 root 27665 owner 17074270 offset 4096 num_refs 0
not found in extent tree
Incorrect local backref count on 2398147911680 root 27665 owner
17074270 offset 4096 found 1 wanted 0 back 0x562ce582c260
backpointer mismatch on [2398147911680 4096]
ref mismatch on [2398176096256 4096] extent item 12, found 13
Backref 2398176096256 root 27665 owner 17074270 offset 8192 num_refs 0
not found in extent tree
Incorrect local backref count on 2398176096256 root 27665 owner
17074270 offset 8192 found 1 wanted 0 back 0x562cd886b7f0
backpointer mismatch on [2398176096256 4096]
ref mismatch on [2398285246464 4096] extent item 12, found 13
Backref 2398285246464 root 27665 owner 17074270 offset 16384 num_refs
0 not found in extent tree
Incorrect local backref count on 2398285246464 root 27665 owner
17074270 offset 16384 found 1 wanted 0 back 0x562cd7e16900
backpointer mismatch on [2398285246464 4096]
ref mismatch on [2404820451328 16384] extent item 0, found 1
Backref 2404820451328 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2404820451328 16384]
owner ref check failed [2404820451328 16384]
ref mismatch on [2405008687104 16384] extent item 0, found 1
Backref 2405008687104 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2405008687104 16384]
owner ref check failed [2405008687104 16384]
ref mismatch on [2405015797760 16384] extent item 0, found 1
Backref 2405015797760 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2405015797760 16384]
owner ref check failed [2405015797760 16384]
ref mismatch on [2405036081152 16384] extent item 0, found 1
Backref 2405036081152 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2405036081152 16384]
owner ref check failed [2405036081152 16384]
ref mismatch on [2405057970176 16384] extent item 0, found 1
Backref 2405057970176 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2405057970176 16384]
owner ref check failed [2405057970176 16384]
ref mismatch on [2405176311808 16384] extent item 0, found 1
Backref 2405176311808 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2405176311808 16384]
owner ref check failed [2405176311808 16384]
ref mismatch on [2477885390848 16384] extent item 0, found 1
Backref 2477885390848 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2477885390848 16384]
owner ref check failed [2477885390848 16384]
ref mismatch on [2478010597376 16384] extent item 0, found 1
Backref 2478010597376 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2478010597376 16384]
ref mismatch on [2478014939136 16384] extent item 0, found 1
Backref 2478014939136 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2478014939136 16384]
owner ref check failed [2478014939136 16384]
ref mismatch on [2478015250432 16384] extent item 0, found 1
Backref 2478015250432 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2478015250432 16384]
ref mismatch on [2478640545792 16384] extent item 0, found 1
Backref 2478640545792 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2478640545792 16384]
ref mismatch on [2478698627072 16384] extent item 0, found 1
Backref 2478698627072 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2478698627072 16384]
ref mismatch on [2478754430976 16384] extent item 0, found 1
Backref 2478754430976 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2478754430976 16384]
ref mismatch on [2940674424832 16384] extent item 0, found 1
Backref 2940674424832 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2940674424832 16384]
ref mismatch on [2940696428544 16384] extent item 0, found 1
Backref 2940696428544 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2940696428544 16384]
ref mismatch on [2940722905088 16384] extent item 0, found 1
Backref 2940722905088 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2940722905088 16384]
ref mismatch on [2940747988992 16384] extent item 0, found 1
Backref 2940747988992 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2940747988992 16384]
ref mismatch on [2940822536192 16384] extent item 0, found 1
Backref 2940822536192 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2940822536192 16384]
owner ref check failed [2940822536192 16384]
ref mismatch on [2940824911872 16384] extent item 0, found 1
Backref 2940824911872 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2940824911872 16384]
ref mismatch on [2940983296000 16384] extent item 0, found 1
Backref 2940983296000 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2940983296000 16384]
ref mismatch on [2940986081280 16384] extent item 0, found 1
Backref 2940986081280 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2940986081280 16384]
owner ref check failed [2940986081280 16384]
ref mismatch on [2941004644352 16384] extent item 0, found 1
Backref 2941004644352 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2941004644352 16384]
owner ref check failed [2941004644352 16384]
ref mismatch on [2941128359936 16384] extent item 0, found 1
Backref 2941128359936 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2941128359936 16384]
ref mismatch on [2941445341184 16384] extent item 0, found 1
Backref 2941445341184 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2941445341184 16384]
ref mismatch on [2941549592576 16384] extent item 0, found 1
Backref 2941549592576 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2941549592576 16384]
ref mismatch on [2993876762624 16384] extent item 0, found 1
Backref 2993876762624 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2993876762624 16384]
owner ref check failed [2993876762624 16384]
ref mismatch on [2993898897408 16384] extent item 0, found 1
Backref 2993898897408 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2993898897408 16384]
ref mismatch on [2993900093440 16384] extent item 0, found 1
Backref 2993900093440 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2993900093440 16384]
ref mismatch on [2993900683264 16384] extent item 0, found 1
Backref 2993900683264 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2993900683264 16384]
ref mismatch on [2993901322240 16384] extent item 0, found 1
Backref 2993901322240 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [2993901322240 16384]
owner ref check failed [2993901322240 16384]
ref mismatch on [4136696893440 8192] extent item 12, found 13
Backref 4136696893440 root 27665 owner 17074280 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4136696893440 root 27665 owner
17074280 offset 0 found 1 wanted 0 back 0x562c82762130
backpointer mismatch on [4136696893440 8192]
ref mismatch on [4136751419392 12288] extent item 12, found 13
Backref 4136751419392 root 27665 owner 17074272 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4136751419392 root 27665 owner
17074272 offset 0 found 1 wanted 0 back 0x562c96c163b0
backpointer mismatch on [4136751419392 12288]
ref mismatch on [4160214544384 8192] extent item 12, found 13
Backref 4160214544384 root 27665 owner 17074273 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4160214544384 root 27665 owner
17074273 offset 0 found 1 wanted 0 back 0x562c8fee4770
backpointer mismatch on [4160214544384 8192]
ref mismatch on [4160523833344 8192] extent item 12, found 13
Backref 4160523833344 root 27665 owner 17074251 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4160523833344 root 27665 owner
17074251 offset 0 found 1 wanted 0 back 0x562ce818bd20
backpointer mismatch on [4160523833344 8192]
ref mismatch on [4160696741888 8192] extent item 12, found 13
Backref 4160696741888 root 27665 owner 17074274 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4160696741888 root 27665 owner
17074274 offset 0 found 1 wanted 0 back 0x562c8276fb90
backpointer mismatch on [4160696741888 8192]
ref mismatch on [4160697847808 8192] extent item 12, found 13
Backref 4160697847808 root 27665 owner 17074277 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4160697847808 root 27665 owner
17074277 offset 0 found 1 wanted 0 back 0x562cd7e0dd60
backpointer mismatch on [4160697847808 8192]
ref mismatch on [4160726593536 8192] extent item 12, found 13
Backref 4160726593536 root 27665 owner 17074279 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4160726593536 root 27665 owner
17074279 offset 0 found 1 wanted 0 back 0x562c74ae8550
backpointer mismatch on [4160726593536 8192]
ref mismatch on [4162150592512 16384] extent item 12, found 13
Backref 4162150592512 root 27665 owner 17074275 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4162150592512 root 27665 owner
17074275 offset 0 found 1 wanted 0 back 0x562cc9365b00
backpointer mismatch on [4162150592512 16384]
ref mismatch on [4162151714816 36864] extent item 12, found 13
Backref 4162151714816 root 27665 owner 17074271 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4162151714816 root 27665 owner
17074271 offset 0 found 1 wanted 0 back 0x562cd0952590
backpointer mismatch on [4162151714816 36864]
ref mismatch on [4162183225344 12288] extent item 12, found 13
Backref 4162183225344 root 27665 owner 17074257 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4162183225344 root 27665 owner
17074257 offset 0 found 1 wanted 0 back 0x562c7f46aba0
backpointer mismatch on [4162183225344 12288]
ref mismatch on [4163704074240 28672] extent item 12, found 13
Backref 4163704074240 root 27665 owner 17074276 offset 0 num_refs 0
not found in extent tree
Incorrect local backref count on 4163704074240 root 27665 owner
17074276 offset 0 found 1 wanted 0 back 0x562ce22465d0
backpointer mismatch on [4163704074240 28672]
ref mismatch on [4197053726720 16384] extent item 0, found 1
Backref 4197053726720 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4197053726720 16384]
ref mismatch on [4240053813248 16384] extent item 0, found 1
Backref 4240053813248 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4240053813248 16384]
owner ref check failed [4240053813248 16384]
ref mismatch on [4240128278528 16384] extent item 0, found 1
Backref 4240128278528 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4240128278528 16384]
owner ref check failed [4240128278528 16384]
ref mismatch on [4240269213696 16384] extent item 0, found 1
Backref 4240269213696 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4240269213696 16384]
owner ref check failed [4240269213696 16384]
ref mismatch on [4240361209856 16384] extent item 0, found 1
Backref 4240361209856 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4240361209856 16384]
owner ref check failed [4240361209856 16384]
ref mismatch on [4240424173568 16384] extent item 0, found 1
Backref 4240424173568 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4240424173568 16384]
owner ref check failed [4240424173568 16384]
ref mismatch on [4537701056512 16384] extent item 0, found 1
Backref 4537701056512 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4537701056512 16384]
owner ref check failed [4537701056512 16384]
ref mismatch on [4627734691840 16384] extent item 0, found 1
Backref 4627734691840 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4627734691840 16384]
owner ref check failed [4627734691840 16384]
ref mismatch on [4627984351232 16384] extent item 0, found 1
Backref 4627984351232 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4627984351232 16384]
owner ref check failed [4627984351232 16384]
ref mismatch on [4627986448384 16384] extent item 0, found 1
Backref 4627986448384 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4627986448384 16384]
ref mismatch on [4628658339840 16384] extent item 0, found 1
Backref 4628658339840 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4628658339840 16384]
owner ref check failed [4628658339840 16384]
ref mismatch on [4628876689408 16384] extent item 0, found 1
Backref 4628876689408 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4628876689408 16384]
owner ref check failed [4628876689408 16384]
ref mismatch on [4629238202368 16384] extent item 0, found 1
Backref 4629238202368 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4629238202368 16384]
owner ref check failed [4629238202368 16384]
ref mismatch on [4629301755904 16384] extent item 0, found 1
Backref 4629301755904 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4629301755904 16384]
owner ref check failed [4629301755904 16384]
ref mismatch on [4629365145600 16384] extent item 0, found 1
Backref 4629365145600 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4629365145600 16384]
owner ref check failed [4629365145600 16384]
ref mismatch on [4629365866496 16384] extent item 0, found 1
Backref 4629365866496 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4629365866496 16384]
ref mismatch on [4629424128000 16384] extent item 0, found 1
Backref 4629424128000 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4629424128000 16384]
owner ref check failed [4629424128000 16384]
ref mismatch on [4629463187456 16384] extent item 0, found 1
Backref 4629463187456 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4629463187456 16384]
owner ref check failed [4629463187456 16384]
ref mismatch on [4629721989120 16384] extent item 0, found 1
Backref 4629721989120 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4629721989120 16384]
ref mismatch on [4631433773056 16384] extent item 0, found 1
Backref 4631433773056 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4631433773056 16384]
owner ref check failed [4631433773056 16384]
ref mismatch on [4631637868544 16384] extent item 0, found 1
Backref 4631637868544 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4631637868544 16384]
owner ref check failed [4631637868544 16384]
ref mismatch on [4632167563264 16384] extent item 0, found 1
Backref 4632167563264 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4632167563264 16384]
owner ref check failed [4632167563264 16384]
ref mismatch on [4632548638720 16384] extent item 0, found 1
Backref 4632548638720 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4632548638720 16384]
owner ref check failed [4632548638720 16384]
ref mismatch on [4632727863296 16384] extent item 0, found 1
Backref 4632727863296 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4632727863296 16384]
owner ref check failed [4632727863296 16384]
ref mismatch on [4633126191104 16384] extent item 0, found 1
Backref 4633126191104 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4633126191104 16384]
owner ref check failed [4633126191104 16384]
ref mismatch on [4634633502720 16384] extent item 0, found 1
Backref 4634633502720 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4634633502720 16384]
owner ref check failed [4634633502720 16384]
ref mismatch on [4637186506752 16384] extent item 0, found 1
Backref 4637186506752 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4637186506752 16384]
ref mismatch on [4656113008640 16384] extent item 0, found 1
Backref 4656113008640 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656113008640 16384]
ref mismatch on [4656480239616 16384] extent item 0, found 1
Backref 4656480239616 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656480239616 16384]
ref mismatch on [4656519987200 16384] extent item 0, found 1
Backref 4656519987200 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656519987200 16384]
ref mismatch on [4656523427840 16384] extent item 0, found 1
Backref 4656523427840 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656523427840 16384]
ref mismatch on [4656548888576 16384] extent item 0, found 1
Backref 4656548888576 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656548888576 16384]
ref mismatch on [4656708648960 16384] extent item 0, found 1
Backref 4656708648960 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656708648960 16384]
ref mismatch on [4656790257664 16384] extent item 0, found 1
Backref 4656790257664 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656790257664 16384]
ref mismatch on [4656802725888 16384] extent item 0, found 1
Backref 4656802725888 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656802725888 16384]
ref mismatch on [4656806215680 16384] extent item 0, found 1
Backref 4656806215680 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656806215680 16384]
owner ref check failed [4656806215680 16384]
ref mismatch on [4656806264832 16384] extent item 0, found 1
Backref 4656806264832 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656806264832 16384]
ref mismatch on [4656880435200 16384] extent item 0, found 1
Backref 4656880435200 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4656880435200 16384]
ref mismatch on [4657100341248 16384] extent item 0, found 1
Backref 4657100341248 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4657100341248 16384]
owner ref check failed [4657100341248 16384]
ref mismatch on [4736962412544 16384] extent item 0, found 1
Backref 4736962412544 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4736962412544 16384]
owner ref check failed [4736962412544 16384]
ref mismatch on [4737106657280 16384] extent item 0, found 1
Backref 4737106657280 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4737106657280 16384]
owner ref check failed [4737106657280 16384]
ref mismatch on [4737143046144 16384] extent item 0, found 1
Backref 4737143046144 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4737143046144 16384]
owner ref check failed [4737143046144 16384]
ref mismatch on [4737511571456 16384] extent item 0, found 1
Backref 4737511571456 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4737511571456 16384]
owner ref check failed [4737511571456 16384]
ref mismatch on [4850508398592 16384] extent item 0, found 1
Backref 4850508398592 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850508398592 16384]
owner ref check failed [4850508398592 16384]
ref mismatch on [4850566594560 16384] extent item 0, found 1
Backref 4850566594560 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850566594560 16384]
owner ref check failed [4850566594560 16384]
ref mismatch on [4850593333248 16384] extent item 0, found 1
Backref 4850593333248 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850593333248 16384]
owner ref check failed [4850593333248 16384]
ref mismatch on [4850611699712 16384] extent item 0, found 1
Backref 4850611699712 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850611699712 16384]
owner ref check failed [4850611699712 16384]
ref mismatch on [4850617221120 16384] extent item 0, found 1
Backref 4850617221120 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850617221120 16384]
owner ref check failed [4850617221120 16384]
ref mismatch on [4850644107264 16384] extent item 0, found 1
Backref 4850644107264 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850644107264 16384]
owner ref check failed [4850644107264 16384]
ref mismatch on [4850652495872 16384] extent item 0, found 1
Backref 4850652495872 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850652495872 16384]
owner ref check failed [4850652495872 16384]
ref mismatch on [4850707054592 16384] extent item 0, found 1
Backref 4850707054592 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850707054592 16384]
owner ref check failed [4850707054592 16384]
ref mismatch on [4850708873216 16384] extent item 0, found 1
Backref 4850708873216 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850708873216 16384]
ref mismatch on [4850785501184 16384] extent item 0, found 1
Backref 4850785501184 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850785501184 16384]
owner ref check failed [4850785501184 16384]
ref mismatch on [4850785615872 16384] extent item 0, found 1
Backref 4850785615872 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850785615872 16384]
owner ref check failed [4850785615872 16384]
ref mismatch on [4850794332160 16384] extent item 0, found 1
Backref 4850794332160 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850794332160 16384]
owner ref check failed [4850794332160 16384]
ref mismatch on [4850805620736 16384] extent item 0, found 1
Backref 4850805620736 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850805620736 16384]
owner ref check failed [4850805620736 16384]
ref mismatch on [4850829279232 16384] extent item 0, found 1
Backref 4850829279232 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850829279232 16384]
owner ref check failed [4850829279232 16384]
ref mismatch on [4850840502272 16384] extent item 0, found 1
Backref 4850840502272 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850840502272 16384]
ref mismatch on [4850840600576 16384] extent item 0, found 1
Backref 4850840600576 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850840600576 16384]
owner ref check failed [4850840600576 16384]
ref mismatch on [4850847301632 16384] extent item 0, found 1
Backref 4850847301632 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850847301632 16384]
ref mismatch on [4850848530432 16384] extent item 0, found 1
Backref 4850848530432 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850848530432 16384]
ref mismatch on [4850874925056 16384] extent item 0, found 1
Backref 4850874925056 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850874925056 16384]
owner ref check failed [4850874925056 16384]
ref mismatch on [4850921144320 16384] extent item 0, found 1
Backref 4850921144320 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850921144320 16384]
owner ref check failed [4850921144320 16384]
ref mismatch on [4850931351552 16384] extent item 0, found 1
Backref 4850931351552 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [4850931351552 16384]
owner ref check failed [4850931351552 16384]
ref mismatch on [5168610377728 16384] extent item 0, found 1
Backref 5168610377728 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [5168610377728 16384]
owner ref check failed [5168610377728 16384]
ref mismatch on [5168614178816 16384] extent item 0, found 1
Backref 5168614178816 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [5168614178816 16384]
owner ref check failed [5168614178816 16384]
ref mismatch on [5168624861184 16384] extent item 0, found 1
Backref 5168624861184 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [5168624861184 16384]
owner ref check failed [5168624861184 16384]
ref mismatch on [5168696754176 16384] extent item 0, found 1
Backref 5168696754176 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [5168696754176 16384]
owner ref check failed [5168696754176 16384]
ref mismatch on [5168913530880 16384] extent item 0, found 1
Backref 5168913530880 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [5168913530880 16384]
owner ref check failed [5168913530880 16384]
ref mismatch on [5168913580032 16384] extent item 0, found 1
Backref 5168913580032 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [5168913580032 16384]
owner ref check failed [5168913580032 16384]
ref mismatch on [5169032200192 16384] extent item 0, found 1
Backref 5169032200192 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [5169032200192 16384]
owner ref check failed [5169032200192 16384]
ref mismatch on [5169189437440 16384] extent item 0, found 1
Backref 5169189437440 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [5169189437440 16384]
owner ref check failed [5169189437440 16384]
ref mismatch on [5169234214912 16384] extent item 0, found 1
Backref 5169234214912 parent 27641 root 27641 not found in extent tree
backpointer mismatch on [5169234214912 16384]
owner ref check failed [5169234214912 16384]

checking free space cache [o]
checkingunresolved ref dir 17093096 index 2 namelen 8 name 15186792
filetype 1 errors 80, filetype mismatch
checkingunresolved ref dir 17124053 index 2 namelen 8 name 15186792
filetype 1 errors 80, filetype mismatch
checkingunresolved ref dir 17133579 index 2 namelen 8 name 15186792
filetype 1 errors 80, filetype mismatch
checking fs roots [.]
found 2804232417285 bytes used err is 1
total csum bytes: 2314569220
total tree bytes: 30477664256
total fs tree bytes: 27351531520
total extent tree bytes: 574193664
btree space waste bytes: 4508064476
file data blocks allocated: 82462010077184
 referenced 9374576852992

How to fix it? Can "btrfs-check --repair --init-extent-tree" help?
P.S. I ran all the commands from Fedora 26 Alpha Live disk with kernel
4.11.0-0.rc3.git0.2.fc26.x86_64 and btrfs-progs v.4.9.1

--
Ivan Sizov