nilfs2: add sanity check in nilfs_btree_add_dirty_buffer

According to the report titled "problem with nilfs_cleanerd" from
Łukasz Wójcicki, nilfs_btree_lookup_dirty_buffers or
nilfs_btree_add_dirty_buffer got memory violation during garbage
collection.

This could happen if a level field of given btree node buffer is
incorrect, which is a crucial internal bug.

This inserts a sanity check to figure out the problem.

Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>

1 files changed, 12 insertions, 0 deletions

diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index b27a342c5af6..386356707f90 100644
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -1920,6 +1920,18 @@ static void nilfs_btree_add_dirty_buffer(struct nilfs_btree *btree,
         node = (struct nilfs_btree_node *)bh->b_data;
         key = nilfs_btree_node_get_key(node, 0);
         level = nilfs_btree_node_get_level(node);
+        if (level < NILFS_BTREE_LEVEL_NODE_MIN ||
+            level >= NILFS_BTREE_LEVEL_MAX) {
+                dump_stack();
+                printk(KERN_WARNING
+                       "%s: invalid btree level: %d (key=%llu, ino=%lu, "
+                       "blocknr=%llu)\n",
+                       __func__, level, (unsigned long long)key,
+                       NILFS_BMAP_I(&btree->bt_bmap)->vfs_inode.i_ino,
+                       (unsigned long long)bh->b_blocknr);
+                return;
+        }
+
         list_for_each(head, &lists[level]) {
                 cbh = list_entry(head, struct buffer_head, b_assoc_buffers);
                 cnode = (struct nilfs_btree_node *)cbh->b_data;