diff mbox series

[v2,1/2] btrfs: prevent NULL pointer dereference in extent_io_tree_panic()

Message ID 20210103092804.756-2-l@damenly.su (mailing list archive)
State New, archived
Headers show
Series btrfs: fix issues when mouting the poc image | expand

Commit Message

Su Yue Jan. 3, 2021, 9:28 a.m. UTC
Some extent io trees are initialized with NULL private member(e.g., btrfs_devi
ce::alloc_state and btrfs_fs_info::excluded_extents). Dereference of a NULL
@tree->private as struct inode * will cause kernel panic.

Just pass @tree->fs_info as parameter to extent_io_tree_panic() directly.
Let it panic as expected at least.

Fixes: 05912a3c04eb ("btrfs: drop extent_io_ops::tree_fs_info callback")
Signed-off-by: Su Yue <l@damenly.su>
---
 fs/btrfs/extent_io.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

Comments

Anand Jain Jan. 4, 2021, 7:33 a.m. UTC | #1
On 3/1/21 5:28 pm, Su Yue wrote:
> Some extent io trees are initialized with NULL private member(e.g., btrfs_devi
> ce::alloc_state and btrfs_fs_info::excluded_extents). Dereference of a NULL
> @tree->private as struct inode * will cause kernel panic.
> 
> Just pass @tree->fs_info as parameter to extent_io_tree_panic() directly.
> Let it panic as expected at least.
> 

  Reviewed-by: Anand Jain <anand.jain@oracle.com>

Thanks.

> Fixes: 05912a3c04eb ("btrfs: drop extent_io_ops::tree_fs_info callback")
> Signed-off-by: Su Yue <l@damenly.su>
diff mbox series

Patch

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 6e3b72e63e42..c9cee458e001 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -676,9 +676,7 @@  alloc_extent_state_atomic(struct extent_state *prealloc)
 
 static void extent_io_tree_panic(struct extent_io_tree *tree, int err)
 {
-	struct inode *inode = tree->private_data;
-
-	btrfs_panic(btrfs_sb(inode->i_sb), err,
+	btrfs_panic(tree->fs_info, err,
 	"locking error: extent tree was modified by another thread while locked");
 }