• Qu Wenruo's avatar
    btrfs: Do super block verification before writing it to disk · 75cb857d
    Qu Wenruo authored
    There are already 2 reports about strangely corrupted super blocks,
    where csum still matches but extra garbage gets slipped into super block.
    
    The corruption would looks like:
    ------
    superblock: bytenr=65536, device=/dev/sdc1
    ---------------------------------------------------------
    csum_type               41700 (INVALID)
    csum                    0x3b252d3a [match]
    bytenr                  65536
    flags                   0x1
                            ( WRITTEN )
    magic                   _BHRfS_M [match]
    ...
    incompat_flags          0x5b22400000000169
                            ( MIXED_BACKREF |
                              COMPRESS_LZO |
                              BIG_METADATA |
                              EXTENDED_IREF |
                              SKINNY_METADATA |
                              unknown flag: 0x5b22400000000000 )
    ...
    ------
    Or
    ------
    superblock: bytenr=65536, device=/dev/mapper/x
    ---------------------------------------------------------
    csum_type              35355 (INVALID)
    csum_size              32
    csum                   0xf0dbeddd [match]
    bytenr                 65536
    flags                  0x1
                           ( WRITTEN )
    magic                  _BHRfS_M [match]
    ...
    incompat_flags         0x176d200000000169
                           ( MIXED_BACKREF |
                             COMPRESS_LZO |
                             BIG_METADATA |
                             EXTENDED_IREF |
                             SKINNY_METADATA |
                             unknown flag: 0x176d200000000000 )
    ------
    
    Obviously, csum_type and incompat_flags get some garbage, but its csum
    still matches, which means kernel calculates the csum based on corrupted
    super block memory.
    And after manually fixing these values, the filesystem is completely
    healthy without any problem exposed by btrfs check.
    
    Although the cause is still unknown, at least detect it and prevent further
    corruption.
    
    Both reports have same symptoms, there's an overwrite on offset 192 of
    the superblock, by 4 bytes. The superblock structure is not allocated or
    freed and stays in the memory for the whole filesystem lifetime, so it's
    not a use-after-free kind of error on someone else's leaked page.
    
    As a vague point for the problable cause is mentioning of other system
    freezing related to graphic card drivers.
    Reported-by: default avatarKen Swenson <flat@imo.uto.moe>
    Reported-by: default avatarBen Parsons <9parsonsb@gmail.com>
    Signed-off-by: default avatarQu Wenruo <wqu@suse.com>
    Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
    [ add brief analysis of the reports ]
    Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
    75cb857d
disk-io.c 125 KB