|
@@ -867,8 +867,16 @@ search_again:
|
|
num_refs = btrfs_extent_refs(leaf, ei);
|
|
num_refs = btrfs_extent_refs(leaf, ei);
|
|
extent_flags = btrfs_extent_flags(leaf, ei);
|
|
extent_flags = btrfs_extent_flags(leaf, ei);
|
|
} else {
|
|
} else {
|
|
- BUG();
|
|
|
|
|
|
+ ret = -EINVAL;
|
|
|
|
+ btrfs_print_v0_err(fs_info);
|
|
|
|
+ if (trans)
|
|
|
|
+ btrfs_abort_transaction(trans, ret);
|
|
|
|
+ else
|
|
|
|
+ btrfs_handle_fs_error(fs_info, ret, NULL);
|
|
|
|
+
|
|
|
|
+ goto out_free;
|
|
}
|
|
}
|
|
|
|
+
|
|
BUG_ON(num_refs == 0);
|
|
BUG_ON(num_refs == 0);
|
|
} else {
|
|
} else {
|
|
num_refs = 0;
|
|
num_refs = 0;
|
|
@@ -1296,6 +1304,10 @@ static noinline int remove_extent_data_ref(struct btrfs_trans_handle *trans,
|
|
ref2 = btrfs_item_ptr(leaf, path->slots[0],
|
|
ref2 = btrfs_item_ptr(leaf, path->slots[0],
|
|
struct btrfs_shared_data_ref);
|
|
struct btrfs_shared_data_ref);
|
|
num_refs = btrfs_shared_data_ref_count(leaf, ref2);
|
|
num_refs = btrfs_shared_data_ref_count(leaf, ref2);
|
|
|
|
+ } else if (key.type == BTRFS_EXTENT_REF_V0_KEY) {
|
|
|
|
+ btrfs_print_v0_err(trans->fs_info);
|
|
|
|
+ btrfs_abort_transaction(trans, -EINVAL);
|
|
|
|
+ return -EINVAL;
|
|
} else {
|
|
} else {
|
|
BUG();
|
|
BUG();
|
|
}
|
|
}
|
|
@@ -1328,6 +1340,8 @@ static noinline u32 extent_data_ref_count(struct btrfs_path *path,
|
|
|
|
|
|
leaf = path->nodes[0];
|
|
leaf = path->nodes[0];
|
|
btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
|
|
btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
|
|
|
|
+
|
|
|
|
+ BUG_ON(key.type == BTRFS_EXTENT_REF_V0_KEY);
|
|
if (iref) {
|
|
if (iref) {
|
|
/*
|
|
/*
|
|
* If type is invalid, we should have bailed out earlier than
|
|
* If type is invalid, we should have bailed out earlier than
|
|
@@ -1541,7 +1555,12 @@ again:
|
|
|
|
|
|
leaf = path->nodes[0];
|
|
leaf = path->nodes[0];
|
|
item_size = btrfs_item_size_nr(leaf, path->slots[0]);
|
|
item_size = btrfs_item_size_nr(leaf, path->slots[0]);
|
|
- BUG_ON(item_size < sizeof(*ei));
|
|
|
|
|
|
+ if (item_size < sizeof(*ei)) {
|
|
|
|
+ err = -EINVAL;
|
|
|
|
+ btrfs_print_v0_err(fs_info);
|
|
|
|
+ btrfs_abort_transaction(trans, err);
|
|
|
|
+ goto out;
|
|
|
|
+ }
|
|
|
|
|
|
ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
|
|
ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
|
|
flags = btrfs_extent_flags(leaf, ei);
|
|
flags = btrfs_extent_flags(leaf, ei);
|
|
@@ -2265,7 +2284,14 @@ again:
|
|
|
|
|
|
leaf = path->nodes[0];
|
|
leaf = path->nodes[0];
|
|
item_size = btrfs_item_size_nr(leaf, path->slots[0]);
|
|
item_size = btrfs_item_size_nr(leaf, path->slots[0]);
|
|
- BUG_ON(item_size < sizeof(*ei));
|
|
|
|
|
|
+
|
|
|
|
+ if (item_size < sizeof(*ei)) {
|
|
|
|
+ err = -EINVAL;
|
|
|
|
+ btrfs_print_v0_err(fs_info);
|
|
|
|
+ btrfs_abort_transaction(trans, err);
|
|
|
|
+ goto out;
|
|
|
|
+ }
|
|
|
|
+
|
|
ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
|
|
ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
|
|
__run_delayed_extent_op(extent_op, leaf, ei);
|
|
__run_delayed_extent_op(extent_op, leaf, ei);
|
|
|
|
|
|
@@ -6796,7 +6822,12 @@ static int __btrfs_free_extent(struct btrfs_trans_handle *trans,
|
|
|
|
|
|
leaf = path->nodes[0];
|
|
leaf = path->nodes[0];
|
|
item_size = btrfs_item_size_nr(leaf, extent_slot);
|
|
item_size = btrfs_item_size_nr(leaf, extent_slot);
|
|
- BUG_ON(item_size < sizeof(*ei));
|
|
|
|
|
|
+ if (item_size < sizeof(*ei)) {
|
|
|
|
+ ret = -EINVAL;
|
|
|
|
+ btrfs_print_v0_err(info);
|
|
|
|
+ btrfs_abort_transaction(trans, ret);
|
|
|
|
+ goto out;
|
|
|
|
+ }
|
|
ei = btrfs_item_ptr(leaf, extent_slot,
|
|
ei = btrfs_item_ptr(leaf, extent_slot,
|
|
struct btrfs_extent_item);
|
|
struct btrfs_extent_item);
|
|
if (owner_objectid < BTRFS_FIRST_FREE_OBJECTID &&
|
|
if (owner_objectid < BTRFS_FIRST_FREE_OBJECTID &&
|