On Tue, Sep 20, 2016 at 03:16:36PM +0200, David Sterba wrote: > On Wed, Sep 14, 2016 at 05:22:57PM -0700, Liu Bo wrote: > > During updating btree, we could push items between sibling > > nodes/leaves, for leaves data sections starts reversely from > > the end of the block while for nodes we only have key pairs > > which are stored one by one from the start of the block. > > > > So we could do try to push key pairs from one node to the next > > node right in the tree, and after that, we update the node's > > nritems to reflect the correct end while leaving the stale > > content in the node. One may intentionally corrupt the fs > > image and access the stale content by bumping the nritems and > > causes various crashes. > > > > This takes the in-memory @nritems as the correct one and > > gets to memset the unused part of a btree node. > > > > Signed-off-by: Liu Bo <bo.li....@oracle.com> > > Reviewed-by: David Sterba <dste...@suse.com> > > > --- > > fs/btrfs/extent_io.c | 11 +++++++++++ > > 1 file changed, 11 insertions(+) > > > > diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c > > index c2325c3..56c9dee 100644 > > --- a/fs/btrfs/extent_io.c > > +++ b/fs/btrfs/extent_io.c > > @@ -3732,6 +3732,17 @@ static noinline_for_stack int write_one_eb(struct > > extent_buffer *eb, > > if (btrfs_header_owner(eb) == BTRFS_TREE_LOG_OBJECTID) > > bio_flags = EXTENT_BIO_TREE_LOG; > > > > + /* set btree node beyond nritems with 0 to avoid stale content */ > > + if (btrfs_header_level(eb) > 0) { > > We can do the same for leaves.
In theory, the problem also applies for leaves, but I haven't got a reproducer for leaf case. So I'll update a v2 with leaf memset, please review that part more carefully :) Thanks, -liubo -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html