[PATCH] btrfs-progs: convert: prevent data chunks to go beyond device size

[PATCH] btrfs-progs: convert: prevent data chunks to go beyond device size

[Qu Wenruo]

[BUG]
There is a bug report that kernel is rejecting a converted btrfs that
has dev extents beyond device boundary.

The invovled device extent is at 999627694980, length is 30924800,
meanwhile the device is 999658557440.

The device is size not aligned to 64K, meanwhile the dev extent is
aligned to 64K.

[CAUSE]
For converted btrfs, the source fs has all its freedom to choose its
size, as long as it's aligned to the fs block size.

So when adding new converted data block groups we need to do extra
alignment, but in make_convert_data_block_groups() we are rounding up
the end, which can exceed the device size.

[FIX]
Instead of rounding up to stripe boundary, rounding it down to prevent
going beyond the device boundary.

Signed-off-by: Qu Wenruo <wqu@suse.com>
---
 convert/main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/convert/main.c b/convert/main.c
index e279e3d40c5f..5c40c08ddd72 100644
--- a/convert/main.c
+++ b/convert/main.c
@@ -948,8 +948,8 @@ static int make_convert_data_block_groups(struct btrfs_trans_handle *trans,
 			u64 cur_backup = cur;
 
 			len = min(max_chunk_size,
-				  round_up(cache->start + cache->size,
-					   BTRFS_STRIPE_LEN) - cur);
+				  round_down(cache->start + cache->size,
+					     BTRFS_STRIPE_LEN) - cur);
 			ret = btrfs_alloc_data_chunk(trans, fs_info, &cur_backup, len);
 			if (ret < 0)
 				break;
-- 
2.51.0

Re: [PATCH] btrfs-progs: convert: prevent data chunks to go beyond device size

[Yuwei Han]

[-- Attachment #1.1: Type: text/plain, Size: 1617 bytes --]



在 2025/10/25 07:30, Qu Wenruo 写道:
> [BUG]
> There is a bug report that kernel is rejecting a converted btrfs that
> has dev extents beyond device boundary.
> 
> The invovled device extent is at 999627694980, length is 30924800,
> meanwhile the device is 999658557440.
> 
> The device is size not aligned to 64K, meanwhile the dev extent is
> aligned to 64K.
> 
> [CAUSE]
> For converted btrfs, the source fs has all its freedom to choose its
> size, as long as it's aligned to the fs block size.
> 
> So when adding new converted data block groups we need to do extra
> alignment, but in make_convert_data_block_groups() we are rounding up
> the end, which can exceed the device size.
> 
> [FIX]
> Instead of rounding up to stripe boundary, rounding it down to prevent
> going beyond the device boundary.
> 
Reported-by: Andieqqq <zeige265975@gmail.com>> Signed-off-by: Qu Wenruo 
<wqu@suse.com>
> ---
>   convert/main.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/convert/main.c b/convert/main.c
> index e279e3d40c5f..5c40c08ddd72 100644
> --- a/convert/main.c
> +++ b/convert/main.c
> @@ -948,8 +948,8 @@ static int make_convert_data_block_groups(struct btrfs_trans_handle *trans,
>   			u64 cur_backup = cur;
>   
>   			len = min(max_chunk_size,
> -				  round_up(cache->start + cache->size,
> -					   BTRFS_STRIPE_LEN) - cur);
> +				  round_down(cache->start + cache->size,
> +					     BTRFS_STRIPE_LEN) - cur);
>   			ret = btrfs_alloc_data_chunk(trans, fs_info, &cur_backup, len);
>   			if (ret < 0)
>   				break;


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]

Re: [PATCH] btrfs-progs: convert: prevent data chunks to go beyond device size

[Filipe Manana]

On Thu, Oct 30, 2025 at 4:17 AM Yuwei Han <hrx@bupt.moe> wrote:
>
>
>
> 在 2025/10/25 07:30, Qu Wenruo 写道:
> > [BUG]
> > There is a bug report that kernel is rejecting a converted btrfs that
> > has dev extents beyond device boundary.
> >
> > The invovled device extent is at 999627694980, length is 30924800,
> > meanwhile the device is 999658557440.
> >
> > The device is size not aligned to 64K, meanwhile the dev extent is
> > aligned to 64K.
> >
> > [CAUSE]
> > For converted btrfs, the source fs has all its freedom to choose its
> > size, as long as it's aligned to the fs block size.
> >
> > So when adding new converted data block groups we need to do extra
> > alignment, but in make_convert_data_block_groups() we are rounding up
> > the end, which can exceed the device size.
> >
> > [FIX]
> > Instead of rounding up to stripe boundary, rounding it down to prevent
> > going beyond the device boundary.
> >
> Reported-by: Andieqqq <zeige265975@gmail.com>

While at it, also add a Link tag pointing to the report....

> Signed-off-by: Qu Wenruo
> <wqu@suse.com>
> > ---
> >   convert/main.c | 4 ++--
> >   1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/convert/main.c b/convert/main.c
> > index e279e3d40c5f..5c40c08ddd72 100644
> > --- a/convert/main.c
> > +++ b/convert/main.c
> > @@ -948,8 +948,8 @@ static int make_convert_data_block_groups(struct btrfs_trans_handle *trans,
> >                       u64 cur_backup = cur;
> >
> >                       len = min(max_chunk_size,
> > -                               round_up(cache->start + cache->size,
> > -                                        BTRFS_STRIPE_LEN) - cur);
> > +                               round_down(cache->start + cache->size,
> > +                                          BTRFS_STRIPE_LEN) - cur);
> >                       ret = btrfs_alloc_data_chunk(trans, fs_info, &cur_backup, len);
> >                       if (ret < 0)
> >                               break;
>

Re: [PATCH] btrfs-progs: convert: prevent data chunks to go beyond device size

[Qu Wenruo]

在 2025/10/30 23:54, Filipe Manana 写道:
> On Thu, Oct 30, 2025 at 4:17 AM Yuwei Han <hrx@bupt.moe> wrote:
>>
>>
>>
>> 在 2025/10/25 07:30, Qu Wenruo 写道:
>>> [BUG]
>>> There is a bug report that kernel is rejecting a converted btrfs that
>>> has dev extents beyond device boundary.
>>>
>>> The invovled device extent is at 999627694980, length is 30924800,
>>> meanwhile the device is 999658557440.
>>>
>>> The device is size not aligned to 64K, meanwhile the dev extent is
>>> aligned to 64K.
>>>
>>> [CAUSE]
>>> For converted btrfs, the source fs has all its freedom to choose its
>>> size, as long as it's aligned to the fs block size.
>>>
>>> So when adding new converted data block groups we need to do extra
>>> alignment, but in make_convert_data_block_groups() we are rounding up
>>> the end, which can exceed the device size.
>>>
>>> [FIX]
>>> Instead of rounding up to stripe boundary, rounding it down to prevent
>>> going beyond the device boundary.
>>>
>> Reported-by: Andieqqq <zeige265975@gmail.com>
> 
> While at it, also add a Link tag pointing to the report....

Sorry, no public report available.

I got a lot of private reports forwarded from Yuwei, as a lot of people 
behind the Great Firewall are not used to github/mail to report a bug.

And this is one example of such private report.

Thanks,
Qu

> 
>> Signed-off-by: Qu Wenruo
>> <wqu@suse.com>
>>> ---
>>>    convert/main.c | 4 ++--
>>>    1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/convert/main.c b/convert/main.c
>>> index e279e3d40c5f..5c40c08ddd72 100644
>>> --- a/convert/main.c
>>> +++ b/convert/main.c
>>> @@ -948,8 +948,8 @@ static int make_convert_data_block_groups(struct btrfs_trans_handle *trans,
>>>                        u64 cur_backup = cur;
>>>
>>>                        len = min(max_chunk_size,
>>> -                               round_up(cache->start + cache->size,
>>> -                                        BTRFS_STRIPE_LEN) - cur);
>>> +                               round_down(cache->start + cache->size,
>>> +                                          BTRFS_STRIPE_LEN) - cur);
>>>                        ret = btrfs_alloc_data_chunk(trans, fs_info, &cur_backup, len);
>>>                        if (ret < 0)
>>>                                break;
>>

Re: [PATCH] btrfs-progs: convert: prevent data chunks to go beyond device size

[David Sterba]

On Sat, Oct 25, 2025 at 10:00:41AM +1030, Qu Wenruo wrote:
> [BUG]
> There is a bug report that kernel is rejecting a converted btrfs that
> has dev extents beyond device boundary.
> 
> The invovled device extent is at 999627694980, length is 30924800,
> meanwhile the device is 999658557440.
> 
> The device is size not aligned to 64K, meanwhile the dev extent is
> aligned to 64K.
> 
> [CAUSE]
> For converted btrfs, the source fs has all its freedom to choose its
> size, as long as it's aligned to the fs block size.
> 
> So when adding new converted data block groups we need to do extra
> alignment, but in make_convert_data_block_groups() we are rounding up
> the end, which can exceed the device size.
> 
> [FIX]
> Instead of rounding up to stripe boundary, rounding it down to prevent
> going beyond the device boundary.
> 
> Signed-off-by: Qu Wenruo <wqu@suse.com>

Added to devel, thanks.