Since btrfs_search_slot() can point to the slot which is beyond the
leaves' capacity, we should pay extra attention when doing afterward
search.
While for lowmem check, several places uses afterward search:
1) Block group item used space check
2) Device item used space check
3) Data extent backref check.
In the following case for block group item check, btrfs lowmem mode
check will skip the block group and report false alert:
leaf
29405184 items 37 free space 1273 generation 11 owner 2
...
item 36 key (
77594624 EXTENT_ITEM 2097152)
extent refs 1 gen 8 flags DATA
extent data backref root 5 objectid 265 offset 0 count 1
leaf
29409280 items 43 free space 670 generation 11 owner 2
item 0 key (
96468992 EXTENT_ITEM 2097152)
extent refs 1 gen 8 flags DATA
extent data backref root 5 objectid 274 offset 0 count 1
item 1 key (
96468992 BLOCK_GROUP_ITEM
33554432)
block group used 2265088 chunk_objectid 256 flags DATA
When checking block group item, we will search key (
96468992 0 0) to
start from the first item in the block group.
While search_slot() will point to leaf
29405184, slot 37 which is beyond
leaf capacity.
And when reading key from slot 37, uninitialized data can be read out
and cause us to exit block group item check, leading to false alert.
Fix it by checking path.slot[0] before reading out the key.
Reported-by: Christoph Anton Mitterer <calestyo@scientia.net>
Reported-by: Chris Murphy <chris@colorremedies.com>
Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.com>
leaf = path.nodes[0];
slot = path.slots[0];
+ if (slot >= btrfs_header_nritems(leaf))
+ goto next;
btrfs_item_key_to_cpu(leaf, &key, slot);
if (key.objectid != objectid || key.type != BTRFS_EXTENT_DATA_KEY)
break;
offset)
found_count++;
+next:
ret = btrfs_next_item(root, &path);
if (ret)
break;
/* Iterate dev_extents to calculate the used space of a device */
while (1) {
- btrfs_item_key_to_cpu(path.nodes[0], &key, path.slots[0]);
+ if (path.slots[0] >= btrfs_header_nritems(path.nodes[0]))
+ goto next;
+ btrfs_item_key_to_cpu(path.nodes[0], &key, path.slots[0]);
if (key.objectid > dev_id)
break;
if (key.type != BTRFS_DEV_EXTENT_KEY || key.objectid != dev_id)
/* Iterate extent tree to account used space */
while (1) {
leaf = path.nodes[0];
+
+ /* Search slot can point to the last item beyond leaf nritems */
+ if (path.slots[0] >= btrfs_header_nritems(leaf))
+ goto next;
+
btrfs_item_key_to_cpu(leaf, &extent_key, path.slots[0]);
if (extent_key.objectid >= bg_key.objectid + bg_key.offset)
break;