Re: [PATCH v2 2/2] btrfs: tree-checker: check if chunk item end oveflows

[Anand Jain <anand.jain@oracle.com>]

>>> The image has a chunk item which has a logical start 37748736 and length
>>> 18446744073701163008. The calculated end 29360127 is overflowed 
>>> obviously.
>>> -EEXIST was caught by insert_state() because of the duplicate end and
>>> extent_io_tree_panic() was called.
>>> Add overflow check of chunk item end in tree checker then the image will
>>> be rejected to be mounted.
>>> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208929
>>> Signed-off-by: Su Yue <l@damenly.su>
>>> ---
>>>   fs/btrfs/tree-checker.c | 7 +++++++
>>>   1 file changed, 7 insertions(+)
>>> diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
>>> index 028e733e42f3..39c65c1cbe96 100644
>>> --- a/fs/btrfs/tree-checker.c
>>> +++ b/fs/btrfs/tree-checker.c
>>> @@ -760,6 +760,7 @@ int btrfs_check_chunk_valid(struct extent_buffer 
>>> *leaf,
>>>   {
>>>       struct btrfs_fs_info *fs_info = leaf->fs_info;
>>>       u64 length;
>>> +    u64 chunk_end;
>>>       u64 stripe_len;
>>>       u16 num_stripes;
>>>       u16 sub_stripes;
>>> @@ -814,6 +815,12 @@ int btrfs_check_chunk_valid(struct extent_buffer 
>>> *leaf,
>>>                 "invalid chunk length, have %llu", length);
>>>           return -EUCLEAN;
>>>       }
>>> +    if (unlikely(check_add_overflow(logical, length, &chunk_end))) {
>>> +        chunk_err(leaf, chunk, logical,
>>> +              "invalid chunk logical/length, have logical %llu 
>>> length %llu",
>>> +              logical, length);
>>> +        return -EUCLEAN;
>>> +    }
>>>       if (unlikely(!is_power_of_2(stripe_len) || stripe_len !=   
>>> BTRFS_STRIPE_LEN)) {
>>>           chunk_err(leaf, chunk, logical,
>>>                 "invalid chunk stripe length: %llu",
>>>
>>
>> So this is a system chunk? It is not so evident from the trace above.
>>
> It's a chunk item located in chunk tree leaf, not in system chunk array.
> Tree checker checks chunk items in both locations.


Ok. Thanks.

Reviewed-by: Anand Jain <anand.jain@oracle.com>