btrfs: handle invalid root reference found in may_destroy_subvol()

The may_destroy_subvol() looks up a root by a key, allowing to do an
inexact search when key->offset is -1.  It's never expected to find such
item, as it would break the allowed range of a root id.

Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index bda91f3100bd84685f2f4b9e0fe1aefa6e4989b4..1a527c7f383bdaa63b2baf0fdb9eb9209d5cc5b9 100644 (file)
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4412,7 +4412,14 @@ static noinline int may_destroy_subvol(struct btrfs_root *root)
        ret = btrfs_search_slot(NULL, fs_info->tree_root, &key, path, 0, 0);
        if (ret < 0)
                goto out;
-       BUG_ON(ret == 0);
+       if (ret == 0) {
+               /*
+                * Key with offset -1 found, there would have to exist a root
+                * with such id, but this is out of valid range.
+                */
+               ret = -EUCLEAN;
+               goto out;
+       }
 
        ret = 0;
        if (path->slots[0] > 0) {