On 2.07.2018 10:53, Qu Wenruo wrote: > > > On 2018年07月02日 15:31, Nikolay Borisov wrote: >> >> >> On 2.07.2018 09:25, Qu Wenruo wrote: >>> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an >>> invalid tree reloc tree can cause kernel NULL pointer dereference when >>> btrfs does some cleanup for reloc roots. >>> >>> It turns out that fs_info->reloc_ctl can be NULL in >>> btrfs_recover_relocation() as we allocate relocation control after all >>> reloc roots are verified. >>> So when we hit out: tag, we haven't call set_reloc_control() thus >>> fs_info->reloc_ctl is still NULL. >>> >>> Reported-by: Xu Wen <wen.xu@xxxxxxxxxx> >>> Signed-off-by: Qu Wenruo <wqu@xxxxxxxx> >>> --- >>> fs/btrfs/relocation.c | 23 ++++++++++++----------- >>> 1 file changed, 12 insertions(+), 11 deletions(-) >>> >>> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c >>> index 879b76fa881a..be94c65bb4d2 100644 >>> --- a/fs/btrfs/relocation.c >>> +++ b/fs/btrfs/relocation.c >>> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root) >>> struct mapping_node *node = NULL; >>> struct reloc_control *rc = fs_info->reloc_ctl; >>> > - spin_lock(&rc->reloc_root_tree.lock); >>> - rb_node = tree_search(&rc->reloc_root_tree.rb_root, >>> - root->node->start); >>> - if (rb_node) { >>> - node = rb_entry(rb_node, struct mapping_node, rb_node); >>> - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); >> >> Just do if (!rc) >> return; >> >> The function is simple enough, no need to indent multiple lines. > > You missed serval lines below, we still have: > --- > spin_lock(&fs_info->trans_lock); > list_del_init(&root->root_list); > spin_unlock(&fs_info->trans_lock); > kfree(node); > --- > > Which still needs to be called even rc is not initialized. But then isn't the function buggy even with your patch because if node is not initialised then we exit at if (!node) return. > > Thanks, > Qu > >>> + if (rc) { >>> + spin_lock(&rc->reloc_root_tree.lock); >>> + rb_node = tree_search(&rc->reloc_root_tree.rb_root, >>> + root->node->start); >>> + if (rb_node) { >>> + node = rb_entry(rb_node, struct mapping_node, rb_node); >>> + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); >>> + } >>> + spin_unlock(&rc->reloc_root_tree.lock); >>> + if (!node) >>> + return; >>> + BUG_ON((struct btrfs_root *)node->data != root); >>> } >>> - spin_unlock(&rc->reloc_root_tree.lock); >>> - >>> - if (!node) >>> - return; >>> - BUG_ON((struct btrfs_root *)node->data != root); >>> >>> spin_lock(&fs_info->trans_lock); >>> list_del_init(&root->root_list); >>> >> -- >> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in >> the body of a message to majordomo@xxxxxxxxxxxxxxx >> More majordomo info at http://vger.kernel.org/majordomo-info.html >> > -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
