| Message ID | 1468219389-28736-1-git-send-email-kernel@kyup.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
On Mon, Jul 11, 2016 at 09:43:09AM +0300, Nikolay Borisov wrote: > The code flow in btrfs_new_inode allows for btrfs_evict_inode to be > called with not fully initialised inode (e.g. ->root member not > being set). This can happen when btrfs_set_inode_index in > btrfs_new_inode fails, which in turn would call iput for the newly > allocated inode. This in turn leads to vfs calling into btrfs_evict_inode. > This leads to null pointer dereference. To handle this situation check whether > the passed inode has root set and just free it in case it doesn't. > > Signed-off-by: Nikolay Borisov <kernel@kyup.com> > Reviewed-by: Josef Bacik <jbacik@fb.com> > --- > fs/btrfs/inode.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > Hello, > > I belive this is fixes the issue reported in > http://thread.gmane.org/gmane.comp.file-systems.btrfs/57809 There's some time left before 4.7 release, so I'll send another pull request, including this patch. -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 07/11/2016 11:48 AM, David Sterba wrote: > On Mon, Jul 11, 2016 at 09:43:09AM +0300, Nikolay Borisov wrote: >> The code flow in btrfs_new_inode allows for btrfs_evict_inode to be >> called with not fully initialised inode (e.g. ->root member not >> being set). This can happen when btrfs_set_inode_index in >> btrfs_new_inode fails, which in turn would call iput for the newly >> allocated inode. This in turn leads to vfs calling into btrfs_evict_inode. >> This leads to null pointer dereference. To handle this situation check whether >> the passed inode has root set and just free it in case it doesn't. >> >> Signed-off-by: Nikolay Borisov <kernel@kyup.com> >> Reviewed-by: Josef Bacik <jbacik@fb.com> >> --- >> fs/btrfs/inode.c | 9 ++++++++- >> 1 file changed, 8 insertions(+), 1 deletion(-) >> >> Hello, >> >> I belive this is fixes the issue reported in >> http://thread.gmane.org/gmane.comp.file-systems.btrfs/57809 > > There's some time left before 4.7 release, so I'll send another pull > request, including this patch. Now that I think about it, shouldn't this also be queued for stable as well? -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, Jul 11, 2016 at 01:57:10PM +0300, Nikolay Borisov wrote: > > > On 07/11/2016 11:48 AM, David Sterba wrote: > > On Mon, Jul 11, 2016 at 09:43:09AM +0300, Nikolay Borisov wrote: > >> The code flow in btrfs_new_inode allows for btrfs_evict_inode to be > >> called with not fully initialised inode (e.g. ->root member not > >> being set). This can happen when btrfs_set_inode_index in > >> btrfs_new_inode fails, which in turn would call iput for the newly > >> allocated inode. This in turn leads to vfs calling into btrfs_evict_inode. > >> This leads to null pointer dereference. To handle this situation check whether > >> the passed inode has root set and just free it in case it doesn't. > >> > >> Signed-off-by: Nikolay Borisov <kernel@kyup.com> > >> Reviewed-by: Josef Bacik <jbacik@fb.com> > >> --- > >> fs/btrfs/inode.c | 9 ++++++++- > >> 1 file changed, 8 insertions(+), 1 deletion(-) > >> > >> Hello, > >> > >> I belive this is fixes the issue reported in > >> http://thread.gmane.org/gmane.comp.file-systems.btrfs/57809 > > > > There's some time left before 4.7 release, so I'll send another pull > > request, including this patch. > > Now that I think about it, shouldn't this also be queued for stable as well? Yes. Marking patches with stable tags has been very inconsistent so we send patches to stable separately. -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 4421954720b8..b51723811d01 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -5159,11 +5159,18 @@ void btrfs_evict_inode(struct inode *inode) struct btrfs_root *root = BTRFS_I(inode)->root; struct btrfs_block_rsv *rsv, *global_rsv; int steal_from_global = 0; - u64 min_size = btrfs_calc_trunc_metadata_size(root, 1); + u64 min_size; int ret; trace_btrfs_inode_evict(inode); + if (!root) { + kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode)); + return; + } + + min_size = btrfs_calc_trunc_metadata_size(root, 1); + evict_inode_truncate_pages(inode); if (inode->i_nlink &&