Re: [PATCH 1/5] btrfs: skip tree blocks in btrfs_get_extent_owner_root()

[Boris Burkov <boris@bur.io>]

On Wed, Nov 04, 2026 at 03:23:19AM -0700, Siddharth Mishra wrote:
> [BUG]
> With simple quotas enabled on a filesystem without the skinny-metadata
> feature, deleting a subvolume triggers the following warning:
> 
>  ------------[ cut here ]------------
>  WARNING: fs/btrfs/extent-tree.c:393 at
>    btrfs_get_extent_inline_ref_type+0x1b9/0x2d0, CPU#1: btrfs-cleaner/84
>  RIP: 0010:btrfs_get_extent_inline_ref_type (fs/btrfs/extent-tree.c:393)
>  Call Trace:
>   <TASK>
>   btrfs_get_extent_owner_root (fs/btrfs/extent-tree.c:3128)
>   btrfs_lookup_extent_info (fs/btrfs/extent-tree.c:187)
>   walk_down_proc (fs/btrfs/extent-tree.c:5647)
>   walk_down_tree (fs/btrfs/extent-tree.c:6170)
>   btrfs_drop_snapshot (fs/btrfs/extent-tree.c:6392)
>   btrfs_clean_one_deleted_snapshot (fs/btrfs/transaction.c:2728)
>   cleaner_kthread (fs/btrfs/disk-io.c:1553)
>   kthread (kernel/kthread.c:436)
>   ret_from_fork (arch/x86/kernel/process.c:158)
>   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
>   </TASK>
>  ---[ end trace 0000000000000000 ]---
>  BTRFS error (device vda): eb 30720000 iref 0x3ee6 invalid extent
>    inline ref type 0
> 
> Writing to a snapshot (update_ref_for_cow()) or a metadata balance
> (relocate_block_group()) trigger the same warning.
> 
> [CAUSE]
> Without skinny-metadata, the extent item of a tree block is an
> EXTENT_ITEM with the TREE_BLOCK flag, and a btrfs_tree_block_info sits
> between the btrfs_extent_item and the first inline ref:
> 
> 	item 3 key (30441472 EXTENT_ITEM 16384) itemoff 16079 itemsize 51
> 		refs 1 gen 5 flags TREE_BLOCK
> 		tree block key (256 INODE_ITEM 0) level 0
> 		^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 		(176 0x5) tree block backref root FS_TREE
> 
> But btrfs_get_extent_owner_root() always takes the first inline ref
> right after the btrfs_extent_item:
> 
> 	ptr = (unsigned long)(ei + 1);
> 
> So for such a tree block it reads the lowest byte of the first key
> objectid as the inline ref type. For the key above that byte is 0, and
> btrfs_get_extent_inline_ref_type() warns. If the byte happens to be
> BTRFS_EXTENT_OWNER_REF_KEY (172), the key bytes are returned as the
> owner root.
> 
> The filesystem is valid. It can be reproduced with:
> 
>   mkfs.btrfs -f -O ^skinny-metadata $dev
>   mount $dev $mnt
>   btrfs quota enable --simple $mnt
>   btrfs subvolume create $mnt/sv
>   btrfs subvolume delete $mnt/sv
>   btrfs subvolume sync $mnt
> 
> [FIX]
> Owner refs are only added to data extents, never to tree blocks, so
> return 0 for an extent item with the TREE_BLOCK flag before looking at
> its inline refs. This covers both the EXTENT_ITEM and the METADATA_ITEM
> layouts, and gives the same result as on a skinny-metadata filesystem,
> where the first inline ref of a tree block is never an owner ref.
> 

Nice catch, LGTM.
Reviewed-by: Boris Burkov <boris@bur.io>

> Fixes: 8d2990914073 ("btrfs: add helper for inline owner ref lookup")
> Cc: stable@vger.kernel.org # 6.7+
> Signed-off-by: Siddharth Mishra <smish149@asu.edu>
> ---
>  fs/btrfs/extent-tree.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
> index 9b0a5c6b9..3ab4f2696 100644
> --- a/fs/btrfs/extent-tree.c
> +++ b/fs/btrfs/extent-tree.c
> @@ -3117,6 +3117,9 @@ u64 btrfs_get_extent_owner_root(struct btrfs_fs_info *fs_info,
>  		return 0;
>  
>  	ei = btrfs_item_ptr(leaf, slot, struct btrfs_extent_item);
> +	if (btrfs_extent_flags(leaf, ei) & BTRFS_EXTENT_FLAG_TREE_BLOCK)
> +		return 0;
> +
>  	ptr = (unsigned long)(ei + 1);
>  	end = (unsigned long)ei + btrfs_item_size(leaf, slot);
>  
> -- 
> 2.54.0
>