Commit 8b117748 authored Jan 19, 2024 by David Sterba Committed by Greg Kroah-Hartman Apr 13, 2024

btrfs: export: handle invalid inode or root reference in btrfs_get_parent()



[ Upstream commit 26b66d1d366a375745755ca7365f67110bbf6bd5 ]

The get_parent handler looks up a parent of a given dentry, this can be
either a subvolume or a directory. The search is set up with offset -1
but it's never expected to find such item, as it would break allowed
range of inode number or a root id. This means it's a corruption (ext4
also returns this error code).

Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent bebd9e0f

fs/btrfs/export.c

+8 −1

Original line number	Original line	Diff line number	Diff line
	@@ -182,8 +182,15 @@ struct dentry btrfs_get_parent(struct dentry child)
	ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);		ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
	if (ret < 0)		if (ret < 0)
	goto fail;		goto fail;
			if (ret == 0) {
			/*
			* Key with offset of -1 found, there would have to exist an
			* inode with such number or a root with such id.
			*/
			ret = -EUCLEAN;
			goto fail;
			}

	BUG_ON(ret == 0); /* Key with offset of -1 found */
	if (path->slots[0] == 0) {		if (path->slots[0] == 0) {
	ret = -ENOENT;		ret = -ENOENT;
	goto fail;		goto fail;