Commit 166ae5a4 authored by Zach Brown's avatar Zach Brown Committed by Chris Mason

btrfs: fix inline compressed read err corruption

uncompress_inline() is dropping the error from btrfs_decompress() after
testing it and zeroing the page that was supposed to hold decompressed
data.  This can silently turn compressed inline data in to zeros if
decompression fails due to corrupt compressed data or memory allocation
failure.

I verified this by manually forcing the error from btrfs_decompress()
for a silly named copy of od:

	if (!strcmp(current->comm, "failod"))
		ret = -ENOMEM;

  # od -x /mnt/btrfs/dir/80 | head -1
  0000000 3031 3038 310a 2d30 6f70 6e69 0a74 3031
  # echo 3 > /proc/sys/vm/drop_caches
  # cp $(which od) /tmp/failod
  # /tmp/failod -x /mnt/btrfs/dir/80 | head -1
  0000000 0000 0000 0000 0000 0000 0000 0000 0000

The fix is to pass the error to its caller.  Which still has a BUG_ON().
So we fix that too.

There seems to be no reason for the zeroing of the page on the error
from btrfs_decompress() but not from the allocation error a few lines
above.  So the page zeroing is removed.
Signed-off-by: default avatarZach Brown <zab@redhat.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.cz>
Signed-off-by: default avatarChris Mason <clm@fb.com>
parent 774bcb35
...@@ -6086,16 +6086,8 @@ static noinline int uncompress_inline(struct btrfs_path *path, ...@@ -6086,16 +6086,8 @@ static noinline int uncompress_inline(struct btrfs_path *path,
max_size = min_t(unsigned long, PAGE_CACHE_SIZE, max_size); max_size = min_t(unsigned long, PAGE_CACHE_SIZE, max_size);
ret = btrfs_decompress(compress_type, tmp, page, ret = btrfs_decompress(compress_type, tmp, page,
extent_offset, inline_size, max_size); extent_offset, inline_size, max_size);
if (ret) {
char *kaddr = kmap_atomic(page);
unsigned long copy_size = min_t(u64,
PAGE_CACHE_SIZE - pg_offset,
max_size - extent_offset);
memset(kaddr + pg_offset, 0, copy_size);
kunmap_atomic(kaddr);
}
kfree(tmp); kfree(tmp);
return 0; return ret;
} }
/* /*
...@@ -6296,7 +6288,10 @@ struct extent_map *btrfs_get_extent(struct inode *inode, struct page *page, ...@@ -6296,7 +6288,10 @@ struct extent_map *btrfs_get_extent(struct inode *inode, struct page *page,
ret = uncompress_inline(path, inode, page, ret = uncompress_inline(path, inode, page,
pg_offset, pg_offset,
extent_offset, item); extent_offset, item);
BUG_ON(ret); /* -ENOMEM */ if (ret) {
err = ret;
goto out;
}
} else { } else {
map = kmap(page); map = kmap(page);
read_extent_buffer(leaf, map + pg_offset, ptr, read_extent_buffer(leaf, map + pg_offset, ptr,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment