xfs
[Top] [All Lists]

Limits on agi->agi_level (and other btree depths?)

To: xfs-oss <xfs@xxxxxxxxxxx>
Subject: Limits on agi->agi_level (and other btree depths?)
From: Eric Sandeen <sandeen@xxxxxxxxxxx>
Date: Wed, 12 Feb 2014 17:54:19 -0600
Delivered-to: xfs@xxxxxxxxxxx
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.3.0
If agi->agi_level exceeds XFS_BTREE_MAXLEVELS (8), bad things happen.  For 
example in xfs_inobt_init_cursor() we read it directly off disk into a btree 
cursor:

xfs_inobt_init_cursor()
        cur->bc_nlevels = be32_to_cpu(agi->agi_level);

and then when it's time to tear it down we'll index into bc_bufs[] buy whatever 
it said:

xfs_btree_del_cursor()
        for (i = 0; i < cur->bc_nlevels; i++) {
                if (cur->bc_bufs[i])
                        xfs_trans_brelse(cur->bc_tp, cur->bc_bufs[i]);

but bc_bufs[] in the xfs_btree_cur is of fixed size:

        struct xfs_buf  *bc_bufs[XFS_BTREE_MAXLEVELS];  /* buf ptr per level */

where

#define XFS_BTREE_MAXLEVELS     8       /* max of all btrees */

(which means this limits any btree depth, not just agi, right...)

...

So I ran across this on an intentionally corrupted image, but I don't know what 
stops us from going past XFS_BTREE_MAXLEVELS in normal operations (unless we 
just hit filesystem limits before then?)

i.e. xfs_btree_new_root() does:

        /* Set the root in the holding structure  increasing the level by 1. */
        cur->bc_ops->set_root(cur, &lptr, 1);

and ->set_root / xfs_inobt_set_root() will happily increase agi_level; I don't 
see anything limiting it to XFS_BTREE_MAXLEVELS.

I guess XFS_BTREE_MAXLEVELS is just an arbitrary in-memory limit, not a limit 
of the underlying disk structures, but as it stands, we should be sure that we 
don't exceed it, right?

I was going to put that limit into xfs_agi_verify, but realized that I wasn't 
sure if we could actually exceed that depth in normal operations.

(cue dchinner working out that 9 levels is 59 bazillion jillion items, and will 
never be hit?)

Thanks,
-Eric

<Prev in Thread] Current Thread [Next in Thread>