Re: [PATCH] btrfs: fix a crash in metadata repair path

[Christoph Hellwig <hch@infradead.org>]

On Fri, May 26, 2023 at 08:30:20PM +0800, Qu Wenruo wrote:
>  	struct btrfs_fs_info *fs_info = eb->fs_info;
> -	u64 start = eb->start;
>  	int i, num_pages = num_extent_pages(eb);
>  	int ret = 0;
>  
> @@ -185,12 +184,14 @@ static int btrfs_repair_eb_io_failure(const struct extent_buffer *eb,
>  
>  	for (i = 0; i < num_pages; i++) {
>  		struct page *p = eb->pages[i];
> +		u64 start = max_t(u64, eb->start, page_offset(p));
> +		u64 end = min_t(u64, eb->start + eb->len, page_offset(p) + PAGE_SIZE);
> +		u32 len = end - start;
>  
> -		ret = btrfs_repair_io_failure(fs_info, 0, start, PAGE_SIZE,
> -				start, p, start - page_offset(p), mirror_num);
> +		ret = btrfs_repair_io_failure(fs_info, 0, start, len,
> +				start, p, offset_in_page(start), mirror_num);
>  		if (ret)
>  			break;
> -		start += PAGE_SIZE;

I actually just noticed this a week or so ago, but didn't have a
reproducer.  My fix  does this a little differeny by adding a branch
for nodesize < PAGE_SIZE similar to write_one_eb or
read_extent_buffer_pages, which feels a bit simpler and easier to read
to me:


diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 48ac9fccca06ae..3d498d08e61b65 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -182,11 +182,19 @@ static int btrfs_repair_eb_io_failure(const struct extent_buffer *eb,
 	if (sb_rdonly(fs_info->sb))
 		return -EROFS;
 
+	if (fs_info->nodesize < PAGE_SIZE) {
+		struct page *p = eb->pages[0];
+
+		return btrfs_repair_io_failure(fs_info, 0, start, eb->len,
+					       start, p, start - page_offset(p),
+					       mirror_num);
+	}
+
 	for (i = 0; i < num_pages; i++) {
 		struct page *p = eb->pages[i];
 
 		ret = btrfs_repair_io_failure(fs_info, 0, start, PAGE_SIZE,
-				start, p, start - page_offset(p), mirror_num);
+					      start, p, 0, mirror_num);
 		if (ret)
 			break;
 		start += PAGE_SIZE;