Re: [PATCH 2/5] btrfs: tree-checker: reject inline refs not matching the extent type

[Boris Burkov <boris@bur.io>]

On Wed, Nov 04, 2026 at 03:23:20AM -0700, Siddharth Mishra wrote:
> [BACKGROUND]
> An extent item is either for a tree block or for data, and each kind
> only gets its own inline ref types:
> 
>   TREE_BLOCK: TREE_BLOCK_REF, SHARED_BLOCK_REF
>   DATA:       EXTENT_OWNER_REF, EXTENT_DATA_REF, SHARED_DATA_REF
> 
> Readers rely on this.  btrfs_get_extent_owner_root() only looks for an
> owner ref on data extents, and btrfs_get_extent_inline_ref_type() warns
> when a caller that expects a tree block ref or a data ref gets the
> other kind.
> 
> [CAUSE]
> check_extent_item() verifies each inline ref on its own, but never
> checks that its type matches the TREE_BLOCK or DATA flag of the extent
> item.  So a data ref or an owner ref on a tree block, or a tree block
> ref on a data extent, passes the tree-checker.  For example this tree
> block has an owner ref instead of its tree block ref:
> 
> 	item 9 key (30478336 METADATA_ITEM 0) itemoff 3636 itemsize 33
> 		refs 1 gen 13 flags TREE_BLOCK
> 		tree block skinny level 0
> 		(172 0x5) extent owner root 5
> 		^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 

I assume this was crafted manually, not via btrfs operations with
squotas enabled, right?

> The leaf is accepted.  When the tree block is freed later,
> lookup_inline_extent_backref() skips the owner ref, finds no tree block
> ref, and the transaction aborts:
> 
>   WARNING: fs/btrfs/extent-tree.c:3418 at __btrfs_free_extent
>   BTRFS error (device vda state A): Transaction 14 aborted (-EUCLEAN)
>   BTRFS info (device vda state EA): forced readonly

This part is not that interesting, kinda garbage in garbage out

> 
> [ENHANCEMENT]
> Reject an inline ref whose type does not match the extent flags with
> -EUCLEAN, so the leaf is refused when it is read:
> 
>   BTRFS critical (device vda): corrupt leaf: block=30441472 slot=9
>   extent bytenr=30478336 len=4096 inline ref type 172 does not match
>   extent flags 0x2

but of course nice to catch more corrupt leaves

> 
> Signed-off-by: Siddharth Mishra <smish149@asu.edu>
> ---
>  fs/btrfs/tree-checker.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
> index f021ac14b..db446c8af 100644
> --- a/fs/btrfs/tree-checker.c
> +++ b/fs/btrfs/tree-checker.c
> @@ -1790,6 +1790,14 @@ static int check_extent_item(struct extent_buffer *leaf,
>  				   inline_type);
>  			return -EUCLEAN;
>  		}

Logic itself is maybe too clever but at least quite compact. LGTM
Reviewed-by: Boris Burkov <boris@bur.io>

> +		if (unlikely(is_tree_block !=
> +			     (inline_type == BTRFS_TREE_BLOCK_REF_KEY ||
> +			      inline_type == BTRFS_SHARED_BLOCK_REF_KEY))) {
> +			extent_err(leaf, slot,
> +			"inline ref type %u does not match extent flags 0x%llx",
> +				   inline_type, flags);
> +			return -EUCLEAN;
> +		}
>  		if (unlikely(inline_type < last_type)) {
>  			extent_err(leaf, slot,
>  				   "inline ref out-of-order: has type %u, prev type %u",
> -- 
> 2.54.0
>