[PATCH 0/2] btrfs: balance item fixes

[Siddharth Mishra <smish149@asu.edu>]

Patch 1 fixes a BUG_ON() in btrfs_balance() on a valid filesystem.  A
balance can leave its item in the root tree when the commit after the
insert fails without an abort, and the next balance then finds the item
and hits BUG_ON(ret == -EEXIST).  syzbot reported it, see patch 1.  The
new balance now overwrites the item that no balance owns.

Patch 2 is hardening.  Nothing checks the size of the balance item, and
btrfs_recover_balance() reads past a short item at mount.  The
tree-checker now rejects a balance item with the wrong size.

Found while looking into a fuzzing report.  An AI tool helped with the
analysis and the patches.

Tested on btrfs for-next df5b88a7914e, KASAN and non-debug kernels:
- Patch 1: on a new filesystem, one failed allocation in
  btrfs_start_dirty_block_groups() during a first balance, then a
  second balance: the BUG_ON() before; with the patch the second
  balance runs to the end, no balance item is left and btrfs check is
  clean.  The same with a failed allocation at each of the first 206
  allocation points of the first balance: no BUG, KASAN report or
  assertion.  Not reproduced without fault injection.  The other way to
  the BUG_ON(), a transaction aborted with -EEXIST, is not reproduced
  on this base: the corrupted image that hit it is now refused by the
  tree-checker at mount.
- Patch 2: a crafted image with a 400 byte balance item is refused at
  mount; valid filesystems (a paused balance resumed or cancelled after
  mount, a balance paused and resumed) are not rejected.
- Both: pause, resume, cancel and skip_balance work as before;
  fstests -g balance and btrfs/220: no new failure.

The crafted image is available on request.

Siddharth Mishra (2):
  btrfs: overwrite a leftover balance item instead of BUG_ON()
  btrfs: tree-checker: add balance item size check

 fs/btrfs/tree-checker.c | 17 +++++++++++++++++
 fs/btrfs/volumes.c      | 10 ++++++----
 2 files changed, 23 insertions(+), 4 deletions(-)


base-commit: df5b88a7914e18488908ddf13e14e31ab39f954c
-- 
2.54.0