btrfs: send: handle path ref underflow in header iterate_inode_ref()

[ Upstream commit 3c6ee34c6f9cd12802326da26631232a61743501 ]

Change BUG_ON to proper error handling if building the path buffer
fails. The pointers are not printed so we don't accidentally leak kernel
addresses.

Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit be2b6bcc936ae17f42fff6494106a5660b35d8d3)
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index fa9797f..b8a697f0 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -965,7 +965,15 @@
 					ret = PTR_ERR(start);
 					goto out;
 				}
-				BUG_ON(start < p->buf);
+				if (unlikely(start < p->buf)) {
+					btrfs_err(root->fs_info,
+			"send: path ref buffer underflow for key (%llu %u %llu)",
+						  found_key->objectid,
+						  found_key->type,
+						  found_key->offset);
+					ret = -EINVAL;
+					goto out;
+				}
 			}
 			p->start = start;
 		} else {