[PATCH 2/5] btrfs: tree-checker: reject inline refs not matching the extent type

[Siddharth Mishra]

[BACKGROUND]
An extent item is either for a tree block or for data, and each kind
only gets its own inline ref types:

  TREE_BLOCK: TREE_BLOCK_REF, SHARED_BLOCK_REF
  DATA:       EXTENT_OWNER_REF, EXTENT_DATA_REF, SHARED_DATA_REF

Readers rely on this.  btrfs_get_extent_owner_root() only looks for an
owner ref on data extents, and btrfs_get_extent_inline_ref_type() warns
when a caller that expects a tree block ref or a data ref gets the
other kind.

[CAUSE]
check_extent_item() verifies each inline ref on its own, but never
checks that its type matches the TREE_BLOCK or DATA flag of the extent
item.  So a data ref or an owner ref on a tree block, or a tree block
ref on a data extent, passes the tree-checker.  For example this tree
block has an owner ref instead of its tree block ref:

	item 9 key (30478336 METADATA_ITEM 0) itemoff 3636 itemsize 33
		refs 1 gen 13 flags TREE_BLOCK
		tree block skinny level 0
		(172 0x5) extent owner root 5
		^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The leaf is accepted.  When the tree block is freed later,
lookup_inline_extent_backref() skips the owner ref, finds no tree block
ref, and the transaction aborts:

  WARNING: fs/btrfs/extent-tree.c:3418 at __btrfs_free_extent
  BTRFS error (device vda state A): Transaction 14 aborted (-EUCLEAN)
  BTRFS info (device vda state EA): forced readonly

[ENHANCEMENT]
Reject an inline ref whose type does not match the extent flags with
-EUCLEAN, so the leaf is refused when it is read:

  BTRFS critical (device vda): corrupt leaf: block=30441472 slot=9
  extent bytenr=30478336 len=4096 inline ref type 172 does not match
  extent flags 0x2

Signed-off-by: Siddharth Mishra <smish149@xxxxxxx>
---
 fs/btrfs/tree-checker.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
index f021ac14b..db446c8af 100644
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -1790,6 +1790,14 @@ static int check_extent_item(struct extent_buffer *leaf,
 				   inline_type);
 			return -EUCLEAN;
 		}
+		if (unlikely(is_tree_block !=
+			     (inline_type == BTRFS_TREE_BLOCK_REF_KEY ||
+			      inline_type == BTRFS_SHARED_BLOCK_REF_KEY))) {
+			extent_err(leaf, slot,
+			"inline ref type %u does not match extent flags 0x%llx",
+				   inline_type, flags);
+			return -EUCLEAN;
+		}
 		if (unlikely(inline_type < last_type)) {
 			extent_err(leaf, slot,
 				   "inline ref out-of-order: has type %u, prev type %u",
-- 
2.54.0