Skip to content

Conversation

@adam900710
Copy link
Collaborator

There is a github bug report about btrfs-convert crash, where
btrfs_print_leaf() is called on NULL path->nodes[0].

The first patch fix the bug by cross-port a fix from kernel part.

The second patch refactor the error handling of __free_extent(), mostly
follow the kernel patch "btrfs: refactor the error handling of __btrfs_free_extent()".

There is a known bug in older kernels that orphan items can be missing
for dropped subvolumes.

This makes those subvolumes unable to be removed on the next mount, and
recent kernel commit 4289b494ac55 ("btrfs: do not allow relocation of
partially dropped subvolumes") introduced one extra safe net to catch
such problem.

But unfortunately there is no way to repair it.

Add the repair ability to both the original and lowmem modes.

Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Qu Wenruo <wqu@suse.com>
The test case fsck/066 is only to verify we can detect the missing root
orphan item, no repair for it yet.

Now the repair ability is added, change the test case to verify the
repair is also properly done.

Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Qu Wenruo <wqu@suse.com>
…xtent()

[BUG]
There is a bug report that btrfs-convert crashed during converting an
ext4 image which is almost full.

[CAUSE]
Just before the crash, btrfs-convert is committing the current
transaction but failed to locate the backref inside __free_extent().

Then it went through the error handling path, which prints an error
message and try to dump the leaf.

But in this particular case, the error code is not -ENOENT, thus the
path is already released, resuling path->nodes[0] to be NULL, and
btrfs_print_leaf() triggers a NULL pointer dereference.

[FIX]
The kernel version of btrfs_free_extent() is only dumping the tree for
-ENOENT error code. And patch "btrfs: refactor the error handling of
__btrfs_free_extent()" is submitted to make abort_and_dump() to only
dump the leaf if the path is not released.

So follow the same kernel patch, by only dumping the leaf if the path is
not released.

Issue: kdave#1064
Signed-off-by: Qu Wenruo <wqu@suse.com>
Just follow the kernel patch "btrfs: refactor the error handling of
__btrfs_free_extent()", to handle the error first for
lookup_extent_backref(), so we can reduce one indent level.

Furthermore remove the unnessary forced type casting of the error
message, and replace the old printk() with proper the error() helper.

Signed-off-by: Qu Wenruo <wqu@suse.com>
kdave pushed a commit that referenced this pull request Nov 25, 2025
…xtent()

[BUG]
There is a bug report that btrfs-convert crashed during converting an
ext4 image which is almost full.

[CAUSE]
Just before the crash, btrfs-convert is committing the current
transaction but failed to locate the backref inside __free_extent().

Then it went through the error handling path, which printed an error
message and tried to dump the leaf.

But in this particular case, the error code is not -ENOENT, thus the
path is already released, resulting path->nodes[0] to be NULL, and
btrfs_print_leaf() triggers a NULL pointer dereference.

[FIX]
The kernel version of btrfs_free_extent() is only dumping the tree for
-ENOENT error code. And patch "btrfs: refactor the error handling of
__btrfs_free_extent()" was submitted to make abort_and_dump() to only
dump the leaf if the path is not released.

So follow the same kernel patch, by only dumping the leaf if the path is
not released.

Issue: #1064
Pull-request: #1065
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
kdave pushed a commit that referenced this pull request Nov 25, 2025
Just follow the kernel patch "btrfs: refactor the error handling of
__btrfs_free_extent()", to handle the error first for
lookup_extent_backref(), so we can reduce one indent level.

Furthermore remove the unnecessary forced type casting of the error
message, and replace the old printk() with proper the error() helper.

Pull-request: #1065
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
@kdave
Copy link
Owner

kdave commented Nov 25, 2025

Merged to devel, thanks.

@kdave kdave closed this Nov 25, 2025
@kdave kdave added this to the v6.18 milestone Nov 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants