Btrfs: fix delalloc accounting leak caused by u32 overflow

osandov · masoncl · commit 70e7af244f24 · 2017-06-09T12:48:36.000-07:00
btrfs_calc_trans_metadata_size() does an unsigned 32-bit multiplication,
which can overflow if num_items &gt;= 4 GB / (nodesize * BTRFS_MAX_LEVEL * 2).
For a nodesize of 16kB, this overflow happens at 16k items. Usually,
num_items is a small constant passed to btrfs_start_transaction(), but
we also use btrfs_calc_trans_metadata_size() for metadata reservations
for extent items in btrfs_delalloc_{reserve,release}_metadata().

In drop_outstanding_extents(), num_items is calculated as
inode-&gt;reserved_extents - inode-&gt;outstanding_extents. The difference
between these two counters is usually small, but if many delalloc
extents are reserved and then the outstanding extents are merged in
btrfs_merge_extent_hook(), the difference can become large enough to
overflow in btrfs_calc_trans_metadata_size().

The overflow manifests itself as a leak of a multiple of 4 GB in
delalloc_block_rsv and the metadata bytes_may_use counter. This in turn
can cause early ENOSPC errors. Additionally, these WARN_ONs in
extent-tree.c will be hit when unmounting:

    WARN_ON(fs_info-&gt;delalloc_block_rsv.size &gt; 0);
    WARN_ON(fs_info-&gt;delalloc_block_rsv.reserved &gt; 0);
    WARN_ON(space_info-&gt;bytes_pinned &gt; 0 ||
            space_info-&gt;bytes_reserved &gt; 0 ||
            space_info-&gt;bytes_may_use &gt; 0);

Fix it by casting nodesize to a u64 so that
btrfs_calc_trans_metadata_size() does a full 64-bit multiplication.
While we're here, do the same in btrfs_calc_trunc_metadata_size(); this
can't overflow with any existing uses, but it's better to be safe here
than have another hard-to-debug problem later on.

Cc: stable@vger.kernel.org
Signed-off-by: Omar Sandoval &lt;osandov@fb.com&gt;
Reviewed-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: Chris Mason &lt;clm@fb.com&gt;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
@@ -2564,7 +2564,7 @@ u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
 static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
 						 unsigned num_items)
 {
-	return fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;
+	return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;
 }
 
 /*
@@ -2574,7 +2574,7 @@ static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
 static inline u64 btrfs_calc_trunc_metadata_size(struct btrfs_fs_info *fs_info,
 						 unsigned num_items)
 {
-	return fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;
+	return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;
 }
 
 int btrfs_should_throttle_delayed_refs(struct btrfs_trans_handle *trans,

Original file line number	Diff line number	Diff line change
`@@ -2564,7 +2564,7 @@ u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);`
`2564`	`2564`	`static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,`
`2565`	`2565`	`unsigned num_items)`
`2566`	`2566`	`{`
`2567`		`- return fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;`
	`2567`	`+ return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;`
`2568`	`2568`	`}`
`2569`	`2569`
`2570`	`2570`	`/*`
`@@ -2574,7 +2574,7 @@ static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,`
`2574`	`2574`	`static inline u64 btrfs_calc_trunc_metadata_size(struct btrfs_fs_info *fs_info,`
`2575`	`2575`	`unsigned num_items)`
`2576`	`2576`	`{`
`2577`		`- return fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;`
	`2577`	`+ return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;`
`2578`	`2578`	`}`
`2579`	`2579`
`2580`	`2580`	`int btrfs_should_throttle_delayed_refs(struct btrfs_trans_handle *trans,`