Commit ebce7d48 authored Jan 24, 2024 by David Sterba Committed by Greg Kroah-Hartman Sep 04, 2024

btrfs: handle invalid root reference found in may_destroy_subvol()



[ Upstream commit 6fbc6f4ac1f4907da4fc674251527e7dc79ffbf6 ]

The may_destroy_subvol() looks up a root by a key, allowing to do an
inexact search when key->offset is -1.  It's never expected to find such
item, as it would break the allowed range of a root id.

Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent be9ce497

fs/btrfs/inode.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -4296,7 +4296,14 @@ static noinline int may_destroy_subvol(struct btrfs_root *root)
		ret = btrfs_search_slot(NULL, fs_info->tree_root, &key, path, 0, 0);
		if (ret < 0)
		goto out;
		BUG_ON(ret == 0);
		if (ret == 0) {
		/*
		* Key with offset -1 found, there would have to exist a root
		* with such id, but this is out of valid range.
		*/
		ret = -EUCLEAN;
		goto out;
		}

		ret = 0;
		if (path->slots[0] > 0) {