Bug 82701 - btrfs restore crashes
Summary: btrfs restore crashes
Status: RESOLVED CODE_FIX
Alias: None
Product: File System
Classification: Unclassified
Component: btrfs (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: Josef Bacik
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-08-18 09:13 UTC by Marc Dietrich
Modified: 2014-09-22 08:47 UTC (History)
2 users (show)

See Also:
Kernel Version: 3.17rc1
Subsystem:
Regression: No
Bisected commit-id:

Attachments
valgrind log from running `btrfs restore` (19.89 KB, text/plain)
2014-08-25 14:45 UTC, Zooko Wilcox-O'Hearn 		Details
Add an attachment (proposed patch, testcase, etc.)

Description Marc Dietrich 2014-08-18 09:13:13 UTC 
I did a checkout of the latest btrfs progs to repair my damaged filesystem. Running btrfs restore gives me several failed to inflate: -6 and crashes with some memory corruption. I ran it again with valgrind and got:

valgrind --log-file=x2 -v --leak-check=yes btrfs restore /dev/sda9 /mnt/backup

==8528== Memcheck, a memory error detector
==8528== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==8528== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==8528== Command: btrfs restore /dev/sda9 /mnt/backup
==8528== Parent PID: 8453
==8528== 
==8528== Syscall param pwrite64(buf) points to uninitialised byte(s)
==8528==    at 0x59BE3C3: __pwrite_nocancel (in /lib64/libpthread-2.18.so)
==8528==    by 0x41F22F: search_dir (cmds-restore.c:392)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528==  Address 0x66956a0 is 7,056 bytes inside a block of size 8,192 alloc'd
==8528==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x41EEAD: search_dir (cmds-restore.c:316)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528== 
==8528== Invalid read of size 1
==8528==    at 0x4C2BF15: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x43818F: read_extent_buffer (string3.h:51)
==8528==    by 0x41EC66: search_dir (cmds-restore.c:233)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528==  Address 0x684c186 is 1,110 bytes inside a block of size 4,224 free'd
==8528==    at 0x4C28ADC: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x437895: free_extent_buffer (extent_io.c:618)
==8528==    by 0x41E053: next_leaf (cmds-restore.c:202)
==8528==    by 0x41E50F: search_dir (cmds-restore.c:731)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528== 
==8528== Invalid read of size 8
==8528==    at 0x4C2BF40: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x43818F: read_extent_buffer (string3.h:51)
==8528==    by 0x41EC66: search_dir (cmds-restore.c:233)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528==  Address 0x684c178 is 1,096 bytes inside a block of size 4,224 free'd
==8528==    at 0x4C28ADC: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x437895: free_extent_buffer (extent_io.c:618)
==8528==    by 0x41E053: next_leaf (cmds-restore.c:202)
==8528==    by 0x41E50F: search_dir (cmds-restore.c:731)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528== 
==8528== Invalid read of size 8
==8528==    at 0x4C2BF52: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x43818F: read_extent_buffer (string3.h:51)
==8528==    by 0x41EC66: search_dir (cmds-restore.c:233)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528==  Address 0x684c168 is 1,080 bytes inside a block of size 4,224 free'd
==8528==    at 0x4C28ADC: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x437895: free_extent_buffer (extent_io.c:618)
==8528==    by 0x41E053: next_leaf (cmds-restore.c:202)
==8528==    by 0x41E50F: search_dir (cmds-restore.c:731)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528== 
==8528== Invalid read of size 1
==8528==    at 0x4C2BFE4: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x43818F: read_extent_buffer (string3.h:51)
==8528==    by 0x41EC66: search_dir (cmds-restore.c:233)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528==  Address 0x6a385f8 is 2,680 bytes inside a block of size 4,224 free'd
==8528==    at 0x4C28ADC: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x437895: free_extent_buffer (extent_io.c:618)
==8528==    by 0x41E053: next_leaf (cmds-restore.c:202)
==8528==    by 0x41E50F: search_dir (cmds-restore.c:731)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528== 
==8528== Invalid read of size 2
==8528==    at 0x4C2BFA0: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x43818F: read_extent_buffer (string3.h:51)
==8528==    by 0x41EC66: search_dir (cmds-restore.c:233)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528==  Address 0x6b0bfb8 is 632 bytes inside a block of size 4,224 free'd
==8528==    at 0x4C28ADC: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x437895: free_extent_buffer (extent_io.c:618)
==8528==    by 0x4261CA: btrfs_release_path (ctree.c:61)
==8528==    by 0x426212: btrfs_free_path (ctree.c:51)
==8528==    by 0x41F93B: search_dir (cmds-restore.c:911)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528== 
==8528== Invalid read of size 2
==8528==    at 0x4C2BFB3: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x43818F: read_extent_buffer (string3.h:51)
==8528==    by 0x41EC66: search_dir (cmds-restore.c:233)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x4204B8: cmd_restore (cmds-restore.c:1284)
==8528==    by 0x4043FE: main (btrfs.c:286)
==8528==  Address 0x6b0bfb4 is 628 bytes inside a block of size 4,224 free'd
==8528==    at 0x4C28ADC: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==8528==    by 0x437895: free_extent_buffer (extent_io.c:618)
==8528==    by 0x4261CA: btrfs_release_path (ctree.c:61)
==8528==    by 0x426212: btrfs_free_path (ctree.c:51)
==8528==    by 0x41F93B: search_dir (cmds-restore.c:911)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528==    by 0x41F8D0: search_dir (cmds-restore.c:895)
==8528== 
==8528== 
==8528== HEAP SUMMARY:
==8528==     in use at exit: 0 bytes in 0 blocks
==8528==   total heap usage: 260,452 allocs, 260,452 frees, 278,189,550 bytes allocated
==8528== 
==8528== All heap blocks were freed -- no leaks are possible
==8528== 
==8528== For counts of detected and suppressed errors, rerun with: -v
==8528== Use --track-origins=yes to see where uninitialised values come from
==8528== ERROR SUMMARY: 16597 errors from 7 contexts (suppressed: 2 from 2)
Comment 1 Marc Dietrich 2014-08-22 08:06:19 UTC 
lastest output from valgrind (see: http://www.spinics.net/lists/linux-btrfs/msg36768.html)

==21984== Memcheck, a memory error detector
==21984== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==21984== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==21984== Command: btrfs restore -x -i  /dev/sda9 /work
==21984== Parent PID: 21917
==21984== 
==21984== Invalid read of size 4
==21984==    at 0x41E2A0: decompress (cmds-restore.c:93)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x668de7e is 53,246 bytes inside a block of size 53,248 alloc'd
==21984==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EE68: search_dir (cmds-restore.c:310)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid read of size 1
==21984==    at 0x57A0E0F: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x668de82 is 2 bytes after a block of size 53,248 alloc'd
==21984==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EE68: search_dir (cmds-restore.c:310)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid read of size 1
==21984==    at 0x57A0F3B: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x668de82 is 2 bytes after a block of size 53,248 alloc'd
==21984==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EE68: search_dir (cmds-restore.c:310)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid read of size 8
==21984==    at 0x57A10C0: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x668de83 is 3 bytes after a block of size 53,248 alloc'd
==21984==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EE68: search_dir (cmds-restore.c:310)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid write of size 8
==21984==    at 0x57A10CB: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x62405a0 is 0 bytes after a block of size 131,072 alloc'd
==21984==    at 0x4C29964: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EEC9: search_dir (cmds-restore.c:317)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid read of size 1
==21984==    at 0x57A1100: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x668de8b is 11 bytes after a block of size 53,248 alloc'd
==21984==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EE68: search_dir (cmds-restore.c:310)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid write of size 1
==21984==    at 0x57A1108: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x62405a8 is 8 bytes after a block of size 131,072 alloc'd
==21984==    at 0x4C29964: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EEC9: search_dir (cmds-restore.c:317)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid read of size 1
==21984==    at 0x57A11BA: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x668de8c is 12 bytes after a block of size 53,248 alloc'd
==21984==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EE68: search_dir (cmds-restore.c:310)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid read of size 2
==21984==    at 0x57A1332: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x668de8d is 13 bytes after a block of size 53,248 alloc'd
==21984==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EE68: search_dir (cmds-restore.c:310)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid read of size 1
==21984==    at 0x57A11A0: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x618ca04 is 4 bytes after a block of size 86,016 alloc'd
==21984==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EE68: search_dir (cmds-restore.c:310)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid write of size 1
==21984==    at 0x57A11A6: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x62e4670 is 0 bytes after a block of size 131,072 alloc'd
==21984==    at 0x4C29964: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EEC9: search_dir (cmds-restore.c:317)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid read of size 1
==21984==    at 0x57A11B1: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x618ca05 is 5 bytes after a block of size 86,016 alloc'd
==21984==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EE68: search_dir (cmds-restore.c:310)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid read of size 1
==21984==    at 0x57A11D4: lzo1x_decompress_safe (in /usr/lib64/liblzo2.so.2.0.0)
==21984==    by 0x41E2CB: decompress (cmds-restore.c:122)
==21984==    by 0x41F1A4: search_dir (cmds-restore.c:379)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x618ca14 is 20 bytes after a block of size 86,016 alloc'd
==21984==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x41EE68: search_dir (cmds-restore.c:310)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== Invalid read of size 1
==21984==    at 0x4C2BFE4: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x438198: read_extent_buffer (string3.h:51)
==21984==    by 0x41EC78: search_dir (cmds-restore.c:234)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x602dcca is not stack'd, malloc'd or (recently) free'd
==21984== 
==21984== Invalid read of size 2
==21984==    at 0x4C2BFA0: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x438198: read_extent_buffer (string3.h:51)
==21984==    by 0x41EC78: search_dir (cmds-restore.c:234)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x603f72c is not stack'd, malloc'd or (recently) free'd
==21984== 
==21984== Invalid read of size 2
==21984==    at 0x4C2BFB3: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x438198: read_extent_buffer (string3.h:51)
==21984==    by 0x41EC78: search_dir (cmds-restore.c:234)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984==  Address 0x603f728 is not stack'd, malloc'd or (recently) free'd
==21984== 
==21984== Invalid read of size 1
==21984==    at 0x4C2BF15: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x438198: read_extent_buffer (string3.h:51)
==21984==    by 0x41EC78: search_dir (cmds-restore.c:234)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==  Address 0x5fce283 is not stack'd, malloc'd or (recently) free'd
==21984== 
==21984== Invalid read of size 8
==21984==    at 0x4C2BF40: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x438198: read_extent_buffer (string3.h:51)
==21984==    by 0x41EC78: search_dir (cmds-restore.c:234)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==  Address 0x5fce278 is not stack'd, malloc'd or (recently) free'd
==21984== 
==21984== Invalid read of size 8
==21984==    at 0x4C2BF52: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x438198: read_extent_buffer (string3.h:51)
==21984==    by 0x41EC78: search_dir (cmds-restore.c:234)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x41F8DE: search_dir (cmds-restore.c:896)
==21984==    by 0x4204C1: cmd_restore (cmds-restore.c:1285)
==21984==  Address 0x5fce268 is 16 bytes after a block of size 136 alloc'd
==21984==    at 0x4C29964: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==21984==    by 0x431C6D: btrfs_read_block_groups (extent-tree.c:3190)
==21984==    by 0x42CEB9: btrfs_setup_all_roots (disk-io.c:925)
==21984==    by 0x42D237: __open_ctree_fd (disk-io.c:1123)
==21984==    by 0x42D2EE: open_ctree_fs_info (disk-io.c:1158)
==21984==    by 0x420595: cmd_restore (cmds-restore.c:986)
==21984==    by 0x4043FE: main (btrfs.c:286)
==21984== 
==21984== 
==21984== HEAP SUMMARY:
==21984==     in use at exit: 0 bytes in 0 blocks
==21984==   total heap usage: 682,689 allocs, 682,689 frees, 1,416,690,615 bytes allocated
==21984== 
==21984== All heap blocks were freed -- no leaks are possible
==21984== 
==21984== For counts of detected and suppressed errors, rerun with: -v
==21984== ERROR SUMMARY: 73017 errors from 19 contexts (suppressed: 2 from 2)
Comment 2 Zooko Wilcox-O'Hearn 2014-08-25 14:45:22 UTC 
Created attachment 148031 [details]
valgrind log from running `btrfs restore`
Comment 3 Zooko Wilcox-O'Hearn 2014-08-25 14:45:44 UTC 
As described in http://thread.gmane.org/gmane.comp.file-systems.btrfs/38023 I have apparently the same problem.

I'll attach my valgrind logs.
Comment 4 Marc Dietrich 2014-09-22 08:47:18 UTC 
all required fixes applied to 3.16.x
Note You need to log in before you can comment on or make changes to this bug.