github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-31 10:33:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

btrfs: tree-checker: introduce checks for FREE_SPACE_BITMAP

Browse Source 
Introduce checks for FREE_SPACE_BITMAP item, which include:

- Key alignment check
  Same as FREE_SPACE_EXTENT, the objectid is the logical bytenr of the
  free space, and offset is the length of the free space, so both
  should be aligned to the fs block size.

- Non-zero range check
  A zero key->offset would describe an empty bitmap, which is invalid.

- Item size check
  The item must hold exactly DIV_ROUND_UP(key->offset >> sectorsize_bits,
  BITS_PER_BYTE) bytes.  A mismatch indicates a truncated or otherwise
  corrupt bitmap item; without this check, the bitmap loading path would
  walk past the end of the leaf and trigger a NULL dereference in
  assert_eb_folio_uptodate().

Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
ZhengYuan Huang 2026-03-11 08:26:10 +10:30 committed by David Sterba
parent b4a1246298
commit 94e445085c
1 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
fs/btrfs/tree-checker.c
View File

@ -2018,6 +2018,46 @@ static int check_free_space_extent(struct extent_buffer *leaf, struct btrfs_key
return 0;
}
static int check_free_space_bitmap(struct extent_buffer *leaf,
struct btrfs_key *key, int slot)
{
struct btrfs_fs_info *fs_info = leaf->fs_info;
const u32 blocksize = fs_info->sectorsize;
u32 expected_item_size;
if (unlikely(!IS_ALIGNED(key->objectid, blocksize))) {
generic_err(leaf, slot,
"free space bitmap key objectid is not aligned to %u, has " BTRFS_KEY_FMT,
blocksize, BTRFS_KEY_FMT_VALUE(key));
return -EUCLEAN;
}
if (unlikely(!IS_ALIGNED(key->offset, blocksize))) {
generic_err(leaf, slot,
"free space bitmap key offset is not aligned to %u, has " BTRFS_KEY_FMT,
blocksize, BTRFS_KEY_FMT_VALUE(key));
return -EUCLEAN;
}
if (unlikely(key->offset == 0)) {
generic_err(leaf, slot, "free space bitmap length is 0");
return -EUCLEAN;
}
/*
* The item must hold exactly the right number of bitmap bytes for the
* range described by key->offset. A mismatch means the item was
* truncated or the key is corrupt; either way the bitmap data is not
* safe to access.
*/
expected_item_size = DIV_ROUND_UP(key->offset >> fs_info->sectorsize_bits,
BITS_PER_BYTE);
if (unlikely(btrfs_item_size(leaf, slot) != expected_item_size)) {
generic_err(leaf, slot,
"invalid item size for free space bitmap, has %u expect %u",
btrfs_item_size(leaf, slot), expected_item_size);
return -EUCLEAN;
}
return 0;
}
/*
* Common point to switch the item-specific validation.
*/
@ -2087,6 +2127,9 @@ static enum btrfs_tree_block_status check_leaf_item(struct extent_buffer *leaf,
case BTRFS_FREE_SPACE_EXTENT_KEY:
ret = check_free_space_extent(leaf, key, slot);
break;
case BTRFS_FREE_SPACE_BITMAP_KEY:
ret = check_free_space_bitmap(leaf, key, slot);
break;
}
if (unlikely(ret))