Re: [PATCH] btrfs: reject zero num_stripes in the system chunk array

[Cheng Yongkang]

Hi Qu,

Removing the ASSERT alone is not sufficient.  btrfs_chunk_item_size()
computes

  sizeof(struct btrfs_chunk) +
  sizeof(struct btrfs_stripe) * (num_stripes - 1)

With num_stripes == 0, the (num_stripes - 1) term underflows in the
unsigned multiplication and the function returns 16 bytes (48 - 32)
instead of a valid item size.  The system chunk array loop would then
advance by the wrong size before btrfs_check_chunk_valid() runs.

So either btrfs_chunk_item_size() has to handle num_stripes == 0 first
(for example, return sizeof(struct btrfs_chunk) and let
btrfs_check_chunk_valid() reject it), or the early check has to stay so
the size calculation is never reached with zero stripes.  I kept the
early check as the minimal fix; if you prefer centralizing the rejection
in the tree-checker, I can change btrfs_chunk_item_size() and drop the
check.

Thanks,
Cheng Yongkang