Commit eaf70ded authored by Filipe Manana's avatar Filipe Manana Committed by Yifan Qiao
Browse files

btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() 

mainline inclusion
from mainline-v6.11-rc1
commit 28cb13f29faf6290597b24b728dc3100c019356f
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX0N
CVE: CVE-2024-46751

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=28cb13f29faf6290597b24b728dc3100c019356f



--------------------------------

Instead of doing a BUG_ON() handle the error by returning -EUCLEAN,
aborting the transaction and logging an error message.

Reviewed-by: default avatarQu Wenruo <wqu@suse.com>
Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
Conflicts:
	fs/btrfs/extent-tree.c
[context differences. No owner now.]
Signed-off-by: default avatarYifan Qiao <qiaoyifan4@huawei.com>
parent cad35f98

fs/btrfs/extent-tree.c

+20 −4
Original line number Diff line number Diff line
@@ -182,8 +182,15 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, 


		ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);

		num_refs = btrfs_extent_refs(leaf, ei);

		if (unlikely(num_refs == 0)) {

			ret = -EUCLEAN;

			btrfs_err(fs_info,

		"unexpected zero reference count for extent item (%llu %u %llu)",

				  key.objectid, key.type, key.offset);

			btrfs_abort_transaction(trans, ret);

			goto out_free;

		}

		extent_flags = btrfs_extent_flags(leaf, ei);

		BUG_ON(num_refs == 0);

	} else {

		num_refs = 0;

		extent_flags = 0;
@@ -213,10 +220,19 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans, 
			goto search_again;

		}

		spin_lock(&head->lock);

		if (head->extent_op && head->extent_op->update_flags)

		if (head->extent_op && head->extent_op->update_flags) {

			extent_flags |= head->extent_op->flags_to_set;

		else

			BUG_ON(num_refs == 0);

		} else if (unlikely(num_refs == 0)) {

			spin_unlock(&head->lock);

			mutex_unlock(&head->mutex);

			spin_unlock(&delayed_refs->lock);

			ret = -EUCLEAN;

			btrfs_err(fs_info,

			  "unexpected zero reference count for extent %llu (%s)",

				  bytenr, metadata ? "metadata" : "data");

			btrfs_abort_transaction(trans, ret);

			goto out_free;

		}



		num_refs += head->ref_mod;

		spin_unlock(&head->lock);