[PATCH] btrfs: ref-verify: handle damaged extent root tree

[PATCH] btrfs: ref-verify: handle damaged extent root tree

[David Sterba]

Syzbot hits a problem with enabled ref-verify, ignorebadroots and a
fuzzed/damaged extent tree. There's no fallback option like in other
places that can deal with it so disable the whole ref-verify as it is
just a debugging feature.

Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com
Signed-off-by: David Sterba <dsterba@suse.com>
---
 fs/btrfs/ref-verify.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
index 3871c3a6c743b5..9f1858b42c0e21 100644
--- a/fs/btrfs/ref-verify.c
+++ b/fs/btrfs/ref-verify.c
@@ -980,11 +980,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)
 	if (!btrfs_test_opt(fs_info, REF_VERIFY))
 		return 0;
 
+	extent_root = btrfs_extent_root(fs_info, 0);
+	/* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */
+	if (IS_ERR(extent_root)) {
+		btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling");
+		btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY);
+		return 0;
+	}
+
 	path = btrfs_alloc_path();
 	if (!path)
 		return -ENOMEM;
 
-	extent_root = btrfs_extent_root(fs_info, 0);
 	eb = btrfs_read_lock_root_node(extent_root);
 	level = btrfs_header_level(eb);
 	path->nodes[level] = eb;
-- 
2.51.0

Re: [PATCH] btrfs: ref-verify: handle damaged extent root tree

[Qu Wenruo]

在 2025/9/15 16:07, David Sterba 写道:
> Syzbot hits a problem with enabled ref-verify, ignorebadroots and a
> fuzzed/damaged extent tree. There's no fallback option like in other
> places that can deal with it so disable the whole ref-verify as it is
> just a debugging feature.
> 
> Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com

Maybe a Link: tag to the original report?

> Signed-off-by: David Sterba <dsterba@suse.com>

Reviewed-by: Qu Wenruo <wqu@suse.com>

Thanks,
Qu


> ---
>   fs/btrfs/ref-verify.c | 9 ++++++++-
>   1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
> index 3871c3a6c743b5..9f1858b42c0e21 100644
> --- a/fs/btrfs/ref-verify.c
> +++ b/fs/btrfs/ref-verify.c
> @@ -980,11 +980,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)
>   	if (!btrfs_test_opt(fs_info, REF_VERIFY))
>   		return 0;
>   
> +	extent_root = btrfs_extent_root(fs_info, 0);
> +	/* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */
> +	if (IS_ERR(extent_root)) {
> +		btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling");
> +		btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY);
> +		return 0;
> +	}
> +
>   	path = btrfs_alloc_path();
>   	if (!path)
>   		return -ENOMEM;
>   
> -	extent_root = btrfs_extent_root(fs_info, 0);
>   	eb = btrfs_read_lock_root_node(extent_root);
>   	level = btrfs_header_level(eb);
>   	path->nodes[level] = eb;

Re: [PATCH] btrfs: ref-verify: handle damaged extent root tree

[Dan Carpenter]

On Mon, Sep 15, 2025 at 08:37:47AM +0200, David Sterba wrote:
> Syzbot hits a problem with enabled ref-verify, ignorebadroots and a
> fuzzed/damaged extent tree. There's no fallback option like in other
> places that can deal with it so disable the whole ref-verify as it is
> just a debugging feature.
> 
> Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com
> Signed-off-by: David Sterba <dsterba@suse.com>
> ---
>  fs/btrfs/ref-verify.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
> index 3871c3a6c743b5..9f1858b42c0e21 100644
> --- a/fs/btrfs/ref-verify.c
> +++ b/fs/btrfs/ref-verify.c
> @@ -980,11 +980,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)
>  	if (!btrfs_test_opt(fs_info, REF_VERIFY))
>  		return 0;
>  
> +	extent_root = btrfs_extent_root(fs_info, 0);
> +	/* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */
> +	if (IS_ERR(extent_root)) {
> +		btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling");
> +		btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY);
> +		return 0;
> +	}


I saw that someone tested a patch for this bug but it doesn't show the
patch itself...

https://lore.kernel.org/all/0000000000004417f5062141fe65@google.com/

Smatch says that btrfs_extent_root() can't return error pointers.  I
would have expected an error pointer dereference to crash in
btrfs_comp_cpu_keys().  The pointer in the bug report
0xdffffc0000000003 is not an error pointer.  What am I missing?

regards,
dan carpenter