btrfs: tree-checker: Verify location key for DIR_ITEM/DIR_INDEX

[PROBLEM]
There is a user report in the mail list, showing the following corrupted
tree blocks:

       item 62 key (486836 DIR_ITEM 2543451757) itemoff 6273 itemsize 74
               location key (4065004 INODE_ITEM 1073741824) type FILE
               transid 21397 data_len 0 name_len 44
               name: FILENAME

Note that location key, its offset should be 0 for all INODE_ITEMS.
This caused failed lookup of the inode.

[CAUSE]
That offending value, 1073741824, is 0x40000000. So this looks like a
memory bit flip.

[FIX]
This patch will enhance tree-checker to check location key of
DIR_INDEX/DIR_ITEM/XATTR_ITEM.

There are several different combinations needs to check:

- item_key.type == DIR_INDEX/DIR_ITEM

  * location_key.type == BTRFS_INODE_ITEM_KEY
    This location_key should follow the check in inode_item check.
  * location_key.type == BTRFS_ROOT_ITEM_KEY
    Despite the existing check, DIR_INDEX/DIR_ITEM can only points to
    subvolume trees.
  * All other keys are not allowed.

- item_key.type == XATTR_ITEM
  location_key should be all 0.

Reported-by: Mike Gilbert <floppymaster@gmail.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
index 9fc438be4bd9364cf8b41c47f952a2659f30e1ac..a92f8a6dd192911b0922de13ebc72ba4fd2ed367 100644 (file)
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -484,12 +484,14 @@ static int check_dir_item(struct extent_buffer *leaf,
                return -EUCLEAN;
        di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item);
        while (cur < item_size) {
+               struct btrfs_key location_key;
                u32 name_len;
                u32 data_len;
                u32 max_name_len;
                u32 total_size;
                u32 name_hash;
                u8 dir_type;
+               int ret;
 
                /* header itself should not cross item boundary */
                if (cur + sizeof(*di) > item_size) {
@@ -499,6 +501,25 @@ static int check_dir_item(struct extent_buffer *leaf,
                        return -EUCLEAN;
                }
 
+               /* Location key check */
+               btrfs_dir_item_key_to_cpu(leaf, di, &location_key);
+               if (location_key.type == BTRFS_ROOT_ITEM_KEY) {
+                       ret = check_root_key(leaf, &location_key, slot);
+                       if (ret < 0)
+                               return ret;
+               } else if (location_key.type == BTRFS_INODE_ITEM_KEY ||
+                          location_key.type == 0) {
+                       ret = check_inode_key(leaf, &location_key, slot);
+                       if (ret < 0)
+                               return ret;
+               } else {
+                       dir_item_err(leaf, slot,
+                       "invalid location key type, have %u, expect %u or %u",
+                                    location_key.type, BTRFS_ROOT_ITEM_KEY,
+                                    BTRFS_INODE_ITEM_KEY);
+                       return -EUCLEAN;
+               }
+
                /* dir type check */
                dir_type = btrfs_dir_type(leaf, di);
                if (dir_type >= BTRFS_FT_MAX) {