diff options
| author | Mikulas Patocka <mpatocka@redhat.com> | 2023-05-30 15:15:41 +0300 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@linux.dev> | 2023-10-23 00:10:04 +0300 |
| commit | 954ed17e029fbf810826739aa190cd559b6e4036 (patch) | |
| tree | bfd79dc83a05937c75dc078781d90d6d274f888f /fs/bcachefs/alloc_foreground.c | |
| parent | b0e8c75e40a863dd40ecdf8fd6f8cdceacb965e5 (diff) | |
| download | linux-954ed17e029fbf810826739aa190cd559b6e4036.tar.xz | |
bcachefs: fix NULL pointer dereference in try_alloc_bucket
On Mon, 29 May 2023, Mikulas Patocka wrote:
> The oops happens in set_btree_iter_dontneed and it is caused by the fact
> that iter->path is NULL. The code in try_alloc_bucket is buggy because it
> sets "struct btree_iter iter = { NULL };" and then jumps to the "err"
> label that tries to dereference values in "iter".
Here I'm sending a patch for it.
From: Mikulas Patocka <mpatocka@redhat.com>
The function try_alloc_bucket sets the variable "iter" to NULL and then
(on various error conditions) jumps to the label "err". On the "err"
label, it calls "set_btree_iter_dontneed" that tries to dereference
"iter->trans" and "iter->path".
So, we get an oops on error condition.
This patch fixes the crash by testing that iter.trans and iter.path is
non-zero before calling set_btree_iter_dontneed.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Diffstat (limited to 'fs/bcachefs/alloc_foreground.c')
| -rw-r--r-- | fs/bcachefs/alloc_foreground.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/bcachefs/alloc_foreground.c b/fs/bcachefs/alloc_foreground.c index a7e6852271d2..95829bbfe033 100644 --- a/fs/bcachefs/alloc_foreground.c +++ b/fs/bcachefs/alloc_foreground.c @@ -371,7 +371,8 @@ static struct open_bucket *try_alloc_bucket(struct btree_trans *trans, struct bc if (!ob) iter.path->preserve = false; err: - set_btree_iter_dontneed(&iter); + if (iter.trans && iter.path) + set_btree_iter_dontneed(&iter); bch2_trans_iter_exit(trans, &iter); printbuf_exit(&buf); return ob; |