[PATCH v2 0/2] btrfs: verify cached extent buffers against tree parent checks

[ZhengYuan Huang]

This series fixes a btrfs crash caused by reusing a cached extent buffer
without re-running the caller supplied tree-parent verification.

The problem happens when a tree block is first read and validated with one
expected level, then later looked up again through a path that derives a
different expected level from corrupted metadata. If the extent buffer is
already marked EXTENT_BUFFER_UPTODATE, the cached-hit path returns it
without re-validating the supplied btrfs_tree_parent_check. This can allow
an inconsistent btrfs_root to be constructed and later lead to a
null-ptr-deref during backref walking.

Patch 1/2 is a preparatory change that extends
btrfs_buffer_uptodate() to support tree-parent verification on cached
buffers. Patch 2/2 uses that support on the cached-hit path and contains
the actual fix.

Together, these changes make cache hits and fresh reads follow the same
tree-parent verification rules, turning the corruption into a read failure
instead of constructing an inconsistent root object and crashing later.

For reference, a more detailed analysis of the trigger path is available at:
https://lore.kernel.org/all/CAOmEq9U14a=pwN_dw2M70gfujhMKki434cfmegoxcyUpkYs5bQ@xxxxxxxxxxxxxx/

Changes since v1:
  - drop the adhoc root-specific consistency check in read_tree_root_path()
  - move the validation into the cached-hit path as suggested by Qu Wenruo
  - extend btrfs_buffer_uptodate() with an optional tree-parent check
  - make read_tree_root_path() pass its check when validating a cached root

ZhengYuan Huang (2):
  btrfs: add tree parent check to btrfs_buffer_uptodate()
  btrfs: revalidate cached tree blocks on the uptodate path

 fs/btrfs/ctree.c       |  2 +-
 fs/btrfs/disk-io.c     | 18 ++++++++++++++----
 fs/btrfs/disk-io.h     |  3 ++-
 fs/btrfs/extent-tree.c |  2 +-
 fs/btrfs/extent_io.c   | 12 ++++++++++--
 fs/btrfs/tree-log.c    |  2 +-
 6 files changed, 29 insertions(+), 10 deletions(-)

-- 
2.43.0