Re: [PATCH] btrfs: reject zero num_stripes in the system chunk array

[Qu Wenruo <wqu@suse.com>]

在 2026/10/30 18:31, Cheng Yongkang 写道:
> Hi Qu,
> 
> Removing the ASSERT alone is not sufficient.  btrfs_chunk_item_size()
> computes
> 
>    sizeof(struct btrfs_chunk) +
>    sizeof(struct btrfs_stripe) * (num_stripes - 1)
> 
> With num_stripes == 0, the (num_stripes - 1) term underflows in the
> unsigned multiplication and the function returns 16 bytes (48 - 32)
> instead of a valid item size.  The system chunk array loop would then
> advance by the wrong size before btrfs_check_chunk_valid() runs.
> 
> So either btrfs_chunk_item_size() has to handle num_stripes == 0 first
> (for example, return sizeof(struct btrfs_chunk) and let
> btrfs_check_chunk_valid() reject it), or the early check has to stay so
> the size calculation is never reached with zero stripes.  I kept the
> early check as the minimal fix; if you prefer centralizing the rejection
> in the tree-checker, I can change btrfs_chunk_item_size() and drop the
> check.

Yes, drop the check and change btrfs_chunk_item_size() to handle zero 
num_stripes is not hard at all, and it's still smaller than your 
original fix:

diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index d5fe5cba0c35..891bc2432870 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -711,9 +711,8 @@ static inline enum btrfs_map_op btrfs_op(const 
struct bio *bio)

  static inline unsigned long btrfs_chunk_item_size(int num_stripes)
  {
-       ASSERT(num_stripes);
-       return sizeof(struct btrfs_chunk) +
-               sizeof(struct btrfs_stripe) * (num_stripes - 1);
+       return offsetof(struct btrfs_chunk, stripe) +
+               sizeof(struct btrfs_stripe) * num_stripes;
  }

  /*


> 
> Thanks,
> Cheng Yongkang