Re: [PATCH 08/20] btrfs: handle invalid extent item reference found in check_committed_ref()

[Qu Wenruo <quwenruo.btrfs@gmx.com>]

On 2024/1/25 07:48, David Sterba wrote:
> The check_committed_ref() helper looks up an extent item by a key,
> allowing to do an inexact search when key->offset is -1.  It's never
> expected to find such item, as it would break the allowed range of a
> extent item offset.
>
> Signed-off-by: David Sterba <dsterba@suse.com>
> ---
>   fs/btrfs/extent-tree.c | 9 ++++++++-
>   1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
> index 4283e3025ab0..ba47f5996c84 100644
> --- a/fs/btrfs/extent-tree.c
> +++ b/fs/btrfs/extent-tree.c
> @@ -2399,7 +2399,14 @@ static noinline int check_committed_ref(struct btrfs_root *root,
>   	ret = btrfs_search_slot(NULL, extent_root, &key, path, 0, 0);
>   	if (ret < 0)
>   		goto out;
> -	BUG_ON(ret == 0); /* Corruption */
> +	if (ret == 0) {
> +		/*
> +		 * Key with offset -1 found, there would have to exist an extent
> +		 * item with such offset, but this is out of the valid range.
> +		 */
> +		ret = -EUCLEAN;
> +		goto out;
> +	}

It looks like we also need an key offset check for extent item.

Thanks,
Qu
>
>   	ret = -ENOENT;
>   	if (path->slots[0] == 0)