Skip to content

Commit 166ae5a

Browse files
Zach Brownmasoncl
Zach Brown
authored andcommitted
btrfs: fix inline compressed read err corruption
uncompress_inline() is dropping the error from btrfs_decompress() after testing it and zeroing the page that was supposed to hold decompressed data. This can silently turn compressed inline data in to zeros if decompression fails due to corrupt compressed data or memory allocation failure. I verified this by manually forcing the error from btrfs_decompress() for a silly named copy of od: if (!strcmp(current->comm, "failod")) ret = -ENOMEM; # od -x /mnt/btrfs/dir/80 | head -1 0000000 3031 3038 310a 2d30 6f70 6e69 0a74 3031 # echo 3 > /proc/sys/vm/drop_caches # cp $(which od) /tmp/failod # /tmp/failod -x /mnt/btrfs/dir/80 | head -1 0000000 0000 0000 0000 0000 0000 0000 0000 0000 The fix is to pass the error to its caller. Which still has a BUG_ON(). So we fix that too. There seems to be no reason for the zeroing of the page on the error from btrfs_decompress() but not from the allocation error a few lines above. So the page zeroing is removed. Signed-off-by: Zach Brown <[email protected]> Reviewed-by: David Sterba <[email protected]> Signed-off-by: Chris Mason <[email protected]>
1 parent 774bcb3 commit 166ae5a

File tree

1 file changed

+5
-10
lines changed

1 file changed

+5
-10
lines changed

fs/btrfs/inode.c

+5-10
Original file line numberDiff line numberDiff line change
@@ -6086,16 +6086,8 @@ static noinline int uncompress_inline(struct btrfs_path *path,
60866086
max_size = min_t(unsigned long, PAGE_CACHE_SIZE, max_size);
60876087
ret = btrfs_decompress(compress_type, tmp, page,
60886088
extent_offset, inline_size, max_size);
6089-
if (ret) {
6090-
char *kaddr = kmap_atomic(page);
6091-
unsigned long copy_size = min_t(u64,
6092-
PAGE_CACHE_SIZE - pg_offset,
6093-
max_size - extent_offset);
6094-
memset(kaddr + pg_offset, 0, copy_size);
6095-
kunmap_atomic(kaddr);
6096-
}
60976089
kfree(tmp);
6098-
return 0;
6090+
return ret;
60996091
}
61006092

61016093
/*
@@ -6296,7 +6288,10 @@ struct extent_map *btrfs_get_extent(struct inode *inode, struct page *page,
62966288
ret = uncompress_inline(path, inode, page,
62976289
pg_offset,
62986290
extent_offset, item);
6299-
BUG_ON(ret); /* -ENOMEM */
6291+
if (ret) {
6292+
err = ret;
6293+
goto out;
6294+
}
63006295
} else {
63016296
map = kmap(page);
63026297
read_extent_buffer(leaf, map + pg_offset, ptr,

0 commit comments

Comments
 (0)