Re: [PATCH 0/5] btrfs: owner refs and tree blocks

[Qu Wenruo]

在 2026/11/4 20:53, Siddharth Mishra 写道:
> Simple quotas store the owner of a data extent in an inline owner ref.
> Tree blocks never get one: their owner is in the tree block header.
>
> Patch 1 fixes btrfs_get_extent_owner_root(), which also looks for an
> owner ref on tree blocks. On a filesystem without skinny-metadata it
> reads the btrfs_tree_block_info as an inline ref and warns on subvolume
> deletion, snapshot writes and balance. The filesystem is valid.
>
> Patches 2 and 3 are hardening. The tree-checker rejects refs whose type
> does not match the extent type: inline refs in patch 2 (for example an
> owner ref on a tree block), and keyed refs in the same leaf as their
> extent item in patch 3.
>
> Patches 4 and 5 are for btrfs-progs (devel 3737c260) and have the same
> cause: a tree block without skinny-metadata is taken for data. mkfs and
> btrfs check do not count such tree blocks in simple quotas, and
> btrfstune --remove-simple-quota can corrupt their extent items.
>
> Found by fuzzing. An AI tool helped with the analysis and the patches.
>
> Tested on btrfs for-next df5b88a7914e, KASAN and non-debug kernels:
> - Patch 1: no warning on subvolume deletion, snapshot writes and
>    metadata balance without skinny-metadata; same qgroup numbers.
> - Patches 2 and 3: crafted images with an owner ref on a tree block,
>    and with a keyed tree block ref on a data extent, are refused at
>    read time instead of aborting a transaction later. No valid
>    filesystem was rejected: skinny and non-skinny, 4K nodes, mixed block
>    groups, no quota, qgroups and simple quotas, with reflinks, snapshots,
>    balance and scrub, and filesystems from btrfs-convert, mkfs --rootdir
>    and btrfstune -x.
> - fstests btrfs/quick, and the qgroup, balance, snapshot and subvol
>    groups with -O ^skinny-metadata: no new failure.
> - Patches 4 and 5: mkfs -O squota,^skinny-metadata writes the right
>    qgroup counts; btrfstune --remove-simple-quota leaves the tree blocks
>    intact and btrfs check is clean (before: "backpointer mismatch").
>
> The crafted images are available on request.
>
> Siddharth Mishra (5):
>    btrfs: skip tree blocks in btrfs_get_extent_owner_root()
>    btrfs: tree-checker: reject inline refs not matching the extent type
>    btrfs: tree-checker: reject keyed refs not matching the extent type
>    btrfs-progs: check: count non-skinny tree blocks in simple quotas
>    btrfs-progs: tune: do not remove owner refs from tree blocks

Please, never mixed progs and kernel patches in one series.

Send them out separately.

>   fs/btrfs/extent-tree.c  |  3 +++
>   fs/btrfs/tree-checker.c | 56 +++++++++++++++++++++++++++++++++++++++--
>   2 files changed, 57 insertions(+), 2 deletions(-)
>
>   check/qgroup-verify.c | 5 +++--
>   tune/quota.c          | 4 +++-
>   2 files changed, 6 insertions(+), 3 deletions(-)
>
>
> base-commit: df5b88a7914e18488908ddf13e14e31ab39f954c