[PATCH 5.10.y] btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() - Linux-stable-mirror

9 May 2025

From: Filipe Manana fdmanana@suse.com
[ Upstream commit 28cb13f29faf6290597b24b728dc3100c019356f ]
Instead of doing a BUG_ON() handle the error by returning -EUCLEAN,
aborting the transaction and logging an error message.
Reviewed-by: Qu Wenruo wqu@suse.com
Signed-off-by: Filipe Manana fdmanana@suse.com
Signed-off-by: David Sterba dsterba@suse.com
[Minor conflict resolved due to code context change.]
Signed-off-by: Jianqi Ren jianqi.ren.cn@windriver.com
Signed-off-by: He Zhe zhe.he@windriver.com
---
Verified the build test
---
 fs/btrfs/extent-tree.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index cf2b65be04b5..d652d4091b2b 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -174,6 +174,14 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
    		ei = btrfs_item_ptr(leaf, path->slots[0],
    				    struct btrfs_extent_item);
    		num_refs = btrfs_extent_refs(leaf, ei);
+			if (unlikely(num_refs == 0)) {
+				ret = -EUCLEAN;
+				btrfs_err(fs_info,
+			"unexpected zero reference count for extent item (%llu %u %llu)",
+					  key.objectid, key.type, key.offset);
+				btrfs_abort_transaction(trans, ret);
+				goto out_free;
+			}
    		extent_flags = btrfs_extent_flags(leaf, ei);
    	} else {
    		ret = -EINVAL;
@@ -185,8 +193,6 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
goto out_free;
    	}
-
-		BUG_ON(num_refs == 0);
    } else {
    	num_refs = 0;
    	extent_flags = 0;
@@ -216,10 +222,19 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
    		goto search_again;
    	}
    	spin_lock(&head->lock);
-		if (head->extent_op && head->extent_op->update_flags)
+		if (head->extent_op && head->extent_op->update_flags) {
    		extent_flags |= head->extent_op->flags_to_set;
-		else
-			BUG_ON(num_refs == 0);
+		} else if (unlikely(num_refs == 0)) {
+			spin_unlock(&head->lock);
+			mutex_unlock(&head->mutex);
+			spin_unlock(&delayed_refs->lock);
+			ret = -EUCLEAN;
+			btrfs_err(fs_info,
+			  "unexpected zero reference count for extent %llu (%s)",
+				  bytenr, metadata ? "metadata" : "data");
+			btrfs_abort_transaction(trans, ret);
+			goto out_free;
+		}
num_refs += head->ref_mod;
    	spin_unlock(&head->lock);
-- 
2.34.1



    