kernel/git/stable/linux.git/fs/btrfs/free-space-cache.c, branch master

btrfs: reject free space cache with more entries than pages

2026-06-29T23:59:04+00:00

When loading a v1 free space cache, __load_free_space_cache() takes num_entries and num_bitmaps straight from the on-disk btrfs_free_space_header. That header is stored in the tree_root under a key with type 0, which the tree-checker has no case for, so neither count is validated before the load trusts it. The load loops num_entries times and maps the next page whenever the current one runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which does io_ctl->pages[io_ctl->index++]. But pages[] is allocated in io_ctl_init() from the cache inode's i_size, not from num_entries: num_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE); io_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS); So if num_entries claims more records than the pages can hold, io_ctl->index runs off the end of pages[]. The write side never hits this because io_ctl_add_entry() and io_ctl_add_bitmap() both stop once io_ctl->index >= io_ctl->num_pages; the read side just never had the same check. To trigger it, take a clean cache (num_entries = here), set num_entries in the header to 0x10000, and fix up the leaf checksum so it still passes the tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and pages[] is a 16-pointer (kmalloc-128) array. The load now tries to read 65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the array: BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565) Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58 io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565) __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820) load_free_space_cache (fs/btrfs/free-space-cache.c:1017) caching_thread (fs/btrfs/block-group.c:880) btrfs_work_helper (fs/btrfs/async-thread.c:312) process_one_work worker_thread kthread ret_from_fork free-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc() at line 565, which is why that is the frame KASAN names. The out-of-bounds slot is then treated as a struct page and handed to crc32c(), so the bad read turns into a GP fault. Add the missing check to io_ctl_check_crc(), which is where both the entry loop and the bitmap loop end up. When num_entries is too large the load now fails like any corrupt cache: __load_free_space_cache() drops it and rebuilds the free space from the extent tree, so a valid cache is never rejected. Reported-by: Weiming Shi Fixes: 5b0e95bf607d ("Btrfs: inline checksums into the disk free space cache") Link: https://lore.kernel.org/linux-btrfs/CAPpSM+RMPByMCKXvM5QFKToxsyNccfuFLWMdD0mfd0wh2Ja62w@mail.gmail.com/ Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Qu Wenruo Signed-off-by: Xiang Mei Reviewed-by: David Sterba Signed-off-by: David Sterba

btrfs: switch local indicator variables to bools

2026-06-09T16:22:46+00:00

For all local indicator variables do simple switch to bool, done on all files. Signed-off-by: David Sterba

btrfs: remove unnecessary ctl argument from write_cache_extent_entries()

2026-06-08T13:53:29+00:00

There is no need to pass the free space control structure as an argument because we can grab it from the given block group. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba

btrfs: remove unnecessary ctl argument from __btrfs_write_out_cache()

2026-06-08T13:53:29+00:00

We can get the free space control structure from the given block group, so there is no need to pass it as an argument. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba

btrfs: remove block group argument from copy_free_space_cache()

2026-06-08T13:53:29+00:00

It's not necessary since we can get the block group from the given free space control structure. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba

btrfs: remove op field from struct btrfs_free_space_ctl

2026-06-08T13:53:29+00:00

The op field always points to the same use_bitmap function, the only exception is during self tests where we make it temporarily point to a different function. So just because of this op pointer field we are increasing the structure size by 8 bytes. Instead of storing a pointer to a use_bitmap function in struct btrfs_free_space_ctl, move the pointer to struct btrfs_info, make insert_into_bitmap() use that pointer if we are running the self tests and initialize that pointer to the current, default use_bitmap function (now exported for the tests as btrfs_use_bitmap). This way we reduce the size of struct btrfs_free_space_ctl from 136 to 128 bytes and can now fit 32 structures in a 4K page instead of 30. This also avoids the cost of the indirection of a function pointer call when we are not running the self tests. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba

btrfs: remove unit field from struct btrfs_free_space_ctl

2026-06-08T13:53:29+00:00

The unit field always has a value matching the sector size, and since we have a block group pointer in the structure, we can access the block group and then its fs_info field to get to the sector size. So remove the field, which will allow us later to shrink the structure size. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba

btrfs: remove start field from struct btrfs_free_space_ctl

2026-06-08T13:53:29+00:00

There's no need for the start field, we can take it from the block group. This reduces the structure size from 152 bytes down to 144 bytes, so on a 4K page system we can now fit 28 structures instead of 26. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba

btrfs: remove folio checked subpage bitmap tracking

2026-06-08T13:53:28+00:00

The folio checked flag is only utilized by the COW fixup mechanism inside btrfs. Since the COW fixup is already removed from non-experimental builds, there is no need to keep the checked subpage bitmap. This will saves us some space for large folios, for example for a single 256K sized large folio on 4K page sized systems: Old bitmap size = 6 * (256K / 4K / 8) = 48 bytes New bitmap size = 5 * (256K / 4K / 8) = 40 bytes This will be more obvious when we're going to support huge folios (order = 9). Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook