[PATCH v2] btrfs: handle zero num_stripes in btrfs_chunk_item_size()

[Cheng Yongkang <teel4res@gmail.com>]

validate_sys_chunk_array() calls btrfs_chunk_item_size() with the
on-disk num_stripes before btrfs_check_chunk_valid() has checked the
chunk. With CONFIG_BTRFS_ASSERT=y, a zero-stripe system chunk trips
ASSERT(num_stripes) instead of being rejected:

  assertion failed: num_stripes, in fs/btrfs/volumes.h:714
  kernel BUG at fs/btrfs/volumes.h:714!
  RIP: 0010:btrfs_validate_super+0x3ce7/0x4210
  Call Trace:
   open_ctree
   btrfs_get_tree
   vfs_get_tree
   do_new_mount

Drop the assertion and compute the size as the chunk header plus
num_stripes stripes. The size is unchanged for num_stripes > 0, and a
zero-stripe chunk now reaches btrfs_check_chunk_valid(), which rejects
it, so the mount fails with -EINVAL.

Tested on btrfs for-next d1dca33127ef with CONFIG_BTRFS_ASSERT=y and
KASAN, using a crafted image whose system chunk array contains a
zero-stripe chunk: without this change, mounting it hits the assertion
above; with it, both read-only and read-write mounts fail with EINVAL
("invalid chunk num_stripes, have 0"). Mounting, writing, reading back
and unmounting a normal filesystem, and btrfs check on it, still pass.

Suggested-by: Qu Wenruo <wqu@suse.com>
Link: https://lore.kernel.org/linux-btrfs/d2ee0cc1-674e-4447-88da-d346122a43a4@suse.com/
Fixes: 2a9bb78cfd36 ("btrfs: validate system chunk array at btrfs_validate_super()")
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
---
Changes in v2:
- Fix btrfs_chunk_item_size() as Qu suggested and drop the early
  zero-stripe check from disk-io.c, along with the comment Filipe
  reviewed.

v1: https://lore.kernel.org/linux-btrfs/179328314071.648427.12527832319954042748@gmail.com/

 fs/btrfs/volumes.h | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index d5fe5cba0..891bc2432 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -711,9 +711,8 @@ static inline enum btrfs_map_op btrfs_op(const struct bio *bio)
 
 static inline unsigned long btrfs_chunk_item_size(int num_stripes)
 {
-	ASSERT(num_stripes);
-	return sizeof(struct btrfs_chunk) +
-		sizeof(struct btrfs_stripe) * (num_stripes - 1);
+	return offsetof(struct btrfs_chunk, stripe) +
+		sizeof(struct btrfs_stripe) * num_stripes;
 }
 
 /*

base-commit: d1dca33127efacd86ac550aa86352f8ea9f29a5a
-- 
2.34.1