> -----Original Message----- > From: linux-btrfs-ow...@vger.kernel.org > [mailto:linux-btrfs-ow...@vger.kernel.org] On Behalf Of Qu Wenruo > Sent: Tuesday, July 03, 2018 5:10 PM > To: linux-btrfs@vger.kernel.org > Subject: [PATCH 3/5] btrfs: relocation: Only remove reloc rb_trees if reloc > control has been initialized > > Invalid tree reloc tree can cause kernel NULL pointer dereference when > btrfs does some cleanup for reloc roots. > > It turns out that fs_info->reloc_ctl can be NULL in > btrfs_recover_relocation() as we allocate relocation control after all > reloc roots are verified. > So when we hit out: tag, we haven't call set_reloc_control() thus > fs_info->reloc_ctl is still NULL. > > Link: https://bugzilla.kernel.org/show_bug.cgi?id=199833 > Reported-by: Xu Wen <wen...@gatech.edu> > Signed-off-by: Qu Wenruo <w...@suse.com> > --- > fs/btrfs/relocation.c | 23 ++++++++++++----------- > 1 file changed, 12 insertions(+), 11 deletions(-) > > diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c > index 879b76fa881a..be94c65bb4d2 100644 > --- a/fs/btrfs/relocation.c > +++ b/fs/btrfs/relocation.c > @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root) > struct mapping_node *node = NULL; > struct reloc_control *rc = fs_info->reloc_ctl; > > - spin_lock(&rc->reloc_root_tree.lock); > - rb_node = tree_search(&rc->reloc_root_tree.rb_root, > - root->node->start); > - if (rb_node) { > - node = rb_entry(rb_node, struct mapping_node, rb_node); > - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); > + if (rc) { > + spin_lock(&rc->reloc_root_tree.lock); > + rb_node = tree_search(&rc->reloc_root_tree.rb_root, > + root->node->start); > + if (rb_node) { > + node = rb_entry(rb_node, struct mapping_node, rb_node); > + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); > + } > + spin_unlock(&rc->reloc_root_tree.lock); > + if (!node) > + return; > + BUG_ON((struct btrfs_root *)node->data != root); > } > - spin_unlock(&rc->reloc_root_tree.lock); > - > - if (!node) > - return; > - BUG_ON((struct btrfs_root *)node->data != root); > > spin_lock(&fs_info->trans_lock); > list_del_init(&root->root_list); > --
Reviewed-by: Gu Jinxiang <g...@cn.fujitsu.com> > 2.18.0 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in > the body of a message to majord...@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > N�Р骒r��y����b�X�肚�v�^�)藓{.n�+�伐�{�n谶�)��骅w* jg�报 �����茛j/�赇z罐���2���ㄨ��&�)摺�a囤�� �G���h��j:+v���w��佶
