Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7ef49515 authored by Qu Wenruo's avatar Qu Wenruo Committed by David Sterba
Browse files

btrfs: Verify that every chunk has corresponding block group at mount time 

If a crafted image has missing block group items, it could cause
unexpected behavior and breaks the assumption of 1:1 chunk<->block group
mapping.

Although we have the block group -> chunk mapping check, we still need
chunk -> block group mapping check.

This patch will do extra check to ensure each chunk has its
corresponding block group.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=199847


Reported-by: default avatarXu Wen <wen.xu@gatech.edu>
Signed-off-by: default avatarQu Wenruo <wqu@suse.com>
Reviewed-by: default avatarGu Jinxiang <gujx@cn.fujitsu.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 514c7dca

fs/btrfs/extent-tree.c

+57 −1
Original line number Diff line number Diff line
@@ -9844,6 +9844,62 @@ btrfs_create_block_group_cache(struct btrfs_fs_info *fs_info, 
	return cache;

}





/*

 * Iterate all chunks and verify that each of them has the corresponding block

 * group

 */

static int check_chunk_block_group_mappings(struct btrfs_fs_info *fs_info)

{

	struct btrfs_mapping_tree *map_tree = &fs_info->mapping_tree;

	struct extent_map *em;

	struct btrfs_block_group_cache *bg;

	u64 start = 0;

	int ret = 0;



	while (1) {

		read_lock(&map_tree->map_tree.lock);

		/*

		 * lookup_extent_mapping will return the first extent map

		 * intersecting the range, so setting @len to 1 is enough to

		 * get the first chunk.

		 */

		em = lookup_extent_mapping(&map_tree->map_tree, start, 1);

		read_unlock(&map_tree->map_tree.lock);

		if (!em)

			break;



		bg = btrfs_lookup_block_group(fs_info, em->start);

		if (!bg) {

			btrfs_err(fs_info,

	"chunk start=%llu len=%llu doesn't have corresponding block group",

				     em->start, em->len);

			ret = -EUCLEAN;

			free_extent_map(em);

			break;

		}

		if (bg->key.objectid != em->start ||

		    bg->key.offset != em->len ||

		    (bg->flags & BTRFS_BLOCK_GROUP_TYPE_MASK) !=

		    (em->map_lookup->type & BTRFS_BLOCK_GROUP_TYPE_MASK)) {

			btrfs_err(fs_info,

"chunk start=%llu len=%llu flags=0x%llx doesn't match block group start=%llu len=%llu flags=0x%llx",

				em->start, em->len,

				em->map_lookup->type & BTRFS_BLOCK_GROUP_TYPE_MASK,

				bg->key.objectid, bg->key.offset,

				bg->flags & BTRFS_BLOCK_GROUP_TYPE_MASK);

			ret = -EUCLEAN;

			free_extent_map(em);

			btrfs_put_block_group(bg);

			break;

		}

		start = em->start + em->len;

		free_extent_map(em);

		btrfs_put_block_group(bg);

	}

	return ret;

}



int btrfs_read_block_groups(struct btrfs_fs_info *info)

{

	struct btrfs_path *path;
@@ -10010,7 +10066,7 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info) 


	btrfs_add_raid_kobjects(info);

	init_global_block_rsv(info);

	ret = 0;

	ret = check_chunk_block_group_mappings(info);

error:

	btrfs_free_path(path);

	return ret;