On 2018年07月02日 15:31, Nikolay Borisov wrote: > > > On 2.07.2018 09:25, Qu Wenruo wrote: >> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an >> invalid tree reloc tree can cause kernel NULL pointer dereference when >> btrfs does some cleanup for reloc roots. >> >> It turns out that fs_info->reloc_ctl can be NULL in >> btrfs_recover_relocation() as we allocate relocation control after all >> reloc roots are verified. >> So when we hit out: tag, we haven't call set_reloc_control() thus >> fs_info->reloc_ctl is still NULL. >> >> Reported-by: Xu Wen <wen.xu@xxxxxxxxxx> >> Signed-off-by: Qu Wenruo <wqu@xxxxxxxx> >> --- >> fs/btrfs/relocation.c | 23 ++++++++++++----------- >> 1 file changed, 12 insertions(+), 11 deletions(-) >> >> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c >> index 879b76fa881a..be94c65bb4d2 100644 >> --- a/fs/btrfs/relocation.c >> +++ b/fs/btrfs/relocation.c >> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root) >> struct mapping_node *node = NULL; >> struct reloc_control *rc = fs_info->reloc_ctl; >> > - spin_lock(&rc->reloc_root_tree.lock); >> - rb_node = tree_search(&rc->reloc_root_tree.rb_root, >> - root->node->start); >> - if (rb_node) { >> - node = rb_entry(rb_node, struct mapping_node, rb_node); >> - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); > > Just do if (!rc) > return; > > The function is simple enough, no need to indent multiple lines. You missed serval lines below, we still have: --- spin_lock(&fs_info->trans_lock); list_del_init(&root->root_list); spin_unlock(&fs_info->trans_lock); kfree(node); --- Which still needs to be called even rc is not initialized. Thanks, Qu >> + if (rc) { >> + spin_lock(&rc->reloc_root_tree.lock); >> + rb_node = tree_search(&rc->reloc_root_tree.rb_root, >> + root->node->start); >> + if (rb_node) { >> + node = rb_entry(rb_node, struct mapping_node, rb_node); >> + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); >> + } >> + spin_unlock(&rc->reloc_root_tree.lock); >> + if (!node) >> + return; >> + BUG_ON((struct btrfs_root *)node->data != root); >> } >> - spin_unlock(&rc->reloc_root_tree.lock); >> - >> - if (!node) >> - return; >> - BUG_ON((struct btrfs_root *)node->data != root); >> >> spin_lock(&fs_info->trans_lock); >> list_del_init(&root->root_list); >> > -- > To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
