[PATCH] btrfs: reject refs=0 subvolume without DEAD in SUBVOL_SYNC_WAIT
From: Cheng Yongkang
Date: Sun Oct 25 2026 - 14:05:20 EST
A crafted image can leave a tree-root ROOT_ITEM with refs==0 and without
BTRFS_ROOT_SUBVOL_DEAD, plus a matching orphan item. Mount accepts it,
and btrfs_ioctl_subvol_sync() then reaches
ASSERT(root_flags & BTRFS_ROOT_SUBVOL_DEAD, ...)
which is BUG() on CONFIG_BTRFS_ASSERT=y.
Return -EUCLEAN instead of asserting, and log the inconsistent state.
The ioctl BUG was reproduced in 2/4 baseline boots (the other two lost
a race to the same image's unrelated cleaner WARN). With this change
the ioctl returns -EUCLEAN and no BUG; a normal btrfs mount/write/
readback/check regression passes.
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@xxxxxxxxx>
---
fs/btrfs/ioctl.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 576cd76..00eab0b 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -5149,8 +5149,12 @@ static int btrfs_ioctl_subvol_sync(struct btrfs_fs_info *fs_info, void __user *a
return -ENOENT;
wait_for_deletion = true;
- ASSERT(root_flags & BTRFS_ROOT_SUBVOL_DEAD, "root_flags=0x%llx",
- root_flags);
+ if (!(root_flags & BTRFS_ROOT_SUBVOL_DEAD)) {
+ btrfs_err(fs_info,
+ "subvol %llu has refs 0 without DEAD flag",
+ args.subvolid);
+ return -EUCLEAN;
+ }
sched_ret = schedule_timeout_interruptible(HZ);
/* Early wake up or error. */
if (sched_ret != 0)
--
2.34.1