From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84CC3C77B73 for ; Fri, 26 May 2023 13:42:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231533AbjEZNml (ORCPT ); Fri, 26 May 2023 09:42:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40140 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229895AbjEZNmk (ORCPT ); Fri, 26 May 2023 09:42:40 -0400 Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 18B9012F for ; Fri, 26 May 2023 06:42:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=bombadil.20210309; h=In-Reply-To:Content-Type:MIME-Version :References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=oGiof5W73OGehUsFFmqWBF+qTn0BzyPAqlHfGqALegk=; b=iJ+LDGHNWLkRdPIWiu9ZIMEKmn d5OCevHxV328pLCRwShgRD7YLF648wRkHi+vUXppbw8RlWDPsWT/Rof6WcExhevEsxZA97a6M6lQr rBQ2/HHyc9LWZyGIiIBc7Nwxlfe90jea2J6VGlLE8JqzyKcTQoOXU/tr8LozpLFpA6U8WTviJ90d6 p/hwYFl0qsak3npVRusQ8wP/3DqNg/Lu/xWYZmbNFT19cWd2vMkM0ISGD8zhRHN8Zl8urMb+i+0UL deci/11rzX3IZARRsnoHO97CH0KWM7PkuDogwcIk/tMyvAtXFuk8oJ4VvoIzXMWT8Q9OXEiKasxmX nhTzt5lg==; Received: from hch by bombadil.infradead.org with local (Exim 4.96 #2 (Red Hat Linux)) id 1q2XiJ-002fkn-2u; Fri, 26 May 2023 13:42:39 +0000 Date: Fri, 26 May 2023 06:42:39 -0700 From: Christoph Hellwig To: Qu Wenruo Cc: linux-btrfs@vger.kernel.org Subject: Re: [PATCH] btrfs: fix a crash in metadata repair path Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-SRS-Rewrite: SMTP reverse-path rewritten from by bombadil.infradead.org. See http://www.infradead.org/rpr.html Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org On Fri, May 26, 2023 at 08:30:20PM +0800, Qu Wenruo wrote: > struct btrfs_fs_info *fs_info = eb->fs_info; > - u64 start = eb->start; > int i, num_pages = num_extent_pages(eb); > int ret = 0; > > @@ -185,12 +184,14 @@ static int btrfs_repair_eb_io_failure(const struct extent_buffer *eb, > > for (i = 0; i < num_pages; i++) { > struct page *p = eb->pages[i]; > + u64 start = max_t(u64, eb->start, page_offset(p)); > + u64 end = min_t(u64, eb->start + eb->len, page_offset(p) + PAGE_SIZE); > + u32 len = end - start; > > - ret = btrfs_repair_io_failure(fs_info, 0, start, PAGE_SIZE, > - start, p, start - page_offset(p), mirror_num); > + ret = btrfs_repair_io_failure(fs_info, 0, start, len, > + start, p, offset_in_page(start), mirror_num); > if (ret) > break; > - start += PAGE_SIZE; I actually just noticed this a week or so ago, but didn't have a reproducer. My fix does this a little differeny by adding a branch for nodesize < PAGE_SIZE similar to write_one_eb or read_extent_buffer_pages, which feels a bit simpler and easier to read to me: diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index 48ac9fccca06ae..3d498d08e61b65 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -182,11 +182,19 @@ static int btrfs_repair_eb_io_failure(const struct extent_buffer *eb, if (sb_rdonly(fs_info->sb)) return -EROFS; + if (fs_info->nodesize < PAGE_SIZE) { + struct page *p = eb->pages[0]; + + return btrfs_repair_io_failure(fs_info, 0, start, eb->len, + start, p, start - page_offset(p), + mirror_num); + } + for (i = 0; i < num_pages; i++) { struct page *p = eb->pages[i]; ret = btrfs_repair_io_failure(fs_info, 0, start, PAGE_SIZE, - start, p, start - page_offset(p), mirror_num); + start, p, 0, mirror_num); if (ret) break; start += PAGE_SIZE;