• Robbie Ko's avatar
    Btrfs: fix tree search logic when replaying directory entry deletes · f1b268d7
    Robbie Ko authored
    commit 2a7bf53f upstream.
    
    If a log tree has a layout like the following:
    
    leaf N:
            ...
            item 240 key (282 DIR_LOG_ITEM 0) itemoff 8189 itemsize 8
                    dir log end 1275809046
    leaf N + 1:
            item 0 key (282 DIR_LOG_ITEM 3936149215) itemoff 16275 itemsize 8
                    dir log end 18446744073709551615
            ...
    
    When we pass the value 1275809046 + 1 as the parameter start_ret to the
    function tree-log.c:find_dir_range() (done by replay_dir_deletes()), we
    end up with path->slots[0] having the value 239 (points to the last item
    of leaf N, item 240). Because the dir log item in that position has an
    offset value smaller than *start_ret (1275809046 + 1) we need to move on
    to the next leaf, however the logic for that is wrong since it compares
    the current slot to the number of items in the leaf, which is smaller
    and therefore we don't lookup for the next leaf but instead we set the
    slot to point to an item that does not exist, at slot 240, and we later
    operate on that slot which has unexpected content or in the worst case
    can result in an invalid memory access (accessing beyond the last page
    of leaf N's extent buffer).
    
    So fix the logic that checks when we need to lookup at the next leaf
    by first incrementing the slot and only after to check if that slot
    is beyond the last item of the current leaf.
    Signed-off-by: default avatarRobbie Ko <robbieko@synology.com>
    Reviewed-by: default avatarFilipe Manana <fdmanana@suse.com>
    Fixes: e02119d5 (Btrfs: Add a write ahead tree log to optimize synchronous operations)
    Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
    [Modified changelog for clarity and correctness]
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    f1b268d7
tree-log.c 154 KB