[PATCH 0/5] btrfs: owner refs and tree blocks

[Siddharth Mishra <smish149@asu.edu>]

Simple quotas store the owner of a data extent in an inline owner ref.
Tree blocks never get one: their owner is in the tree block header.

Patch 1 fixes btrfs_get_extent_owner_root(), which also looks for an
owner ref on tree blocks. On a filesystem without skinny-metadata it
reads the btrfs_tree_block_info as an inline ref and warns on subvolume
deletion, snapshot writes and balance. The filesystem is valid.

Patches 2 and 3 are hardening. The tree-checker rejects refs whose type
does not match the extent type: inline refs in patch 2 (for example an
owner ref on a tree block), and keyed refs in the same leaf as their
extent item in patch 3.

Patches 4 and 5 are for btrfs-progs (devel 3737c260) and have the same
cause: a tree block without skinny-metadata is taken for data. mkfs and
btrfs check do not count such tree blocks in simple quotas, and
btrfstune --remove-simple-quota can corrupt their extent items.

Found by fuzzing. An AI tool helped with the analysis and the patches.

Tested on btrfs for-next df5b88a7914e, KASAN and non-debug kernels:
- Patch 1: no warning on subvolume deletion, snapshot writes and
  metadata balance without skinny-metadata; same qgroup numbers.
- Patches 2 and 3: crafted images with an owner ref on a tree block,
  and with a keyed tree block ref on a data extent, are refused at
  read time instead of aborting a transaction later. No valid
  filesystem was rejected: skinny and non-skinny, 4K nodes, mixed block
  groups, no quota, qgroups and simple quotas, with reflinks, snapshots,
  balance and scrub, and filesystems from btrfs-convert, mkfs --rootdir
  and btrfstune -x.
- fstests btrfs/quick, and the qgroup, balance, snapshot and subvol
  groups with -O ^skinny-metadata: no new failure.
- Patches 4 and 5: mkfs -O squota,^skinny-metadata writes the right
  qgroup counts; btrfstune --remove-simple-quota leaves the tree blocks
  intact and btrfs check is clean (before: "backpointer mismatch").

The crafted images are available on request.

Siddharth Mishra (5):
  btrfs: skip tree blocks in btrfs_get_extent_owner_root()
  btrfs: tree-checker: reject inline refs not matching the extent type
  btrfs: tree-checker: reject keyed refs not matching the extent type
  btrfs-progs: check: count non-skinny tree blocks in simple quotas
  btrfs-progs: tune: do not remove owner refs from tree blocks

 fs/btrfs/extent-tree.c  |  3 +++
 fs/btrfs/tree-checker.c | 56 +++++++++++++++++++++++++++++++++++++++--
 2 files changed, 57 insertions(+), 2 deletions(-)

 check/qgroup-verify.c | 5 +++--
 tune/quota.c          | 4 +++-
 2 files changed, 6 insertions(+), 3 deletions(-)


base-commit: df5b88a7914e18488908ddf13e14e31ab39f954c
-- 
2.54.0