On Thu, Mar 14, 2019 at 09:54:07AM +0200, Nikolay Borisov wrote: > > > On 14.03.19 г. 9:50 ч., Kangjie Lu wrote: > > btrfs_lookup_block_group may fail and return NULL. The fix goes > > to out when it fails to avoid NULL pointer dereference. > > Actually no, in this case btrfs_lookup_block_group must never fail > because if we have an allocated eb then it must have been allocated from > a bg. >
Agreed, we only get to btrfs_free_tree_block() if we are actually deleting the extent buffer. We would have had to read in the extent buffer first to get here, which would have failed if there was no block group. We can't get into this situation with a specifically crafted file system to exploit this as we'd bail out well before we could get to btrfs_free_tree_block(). Adding an ASSERT() makes sure developers aren't doing anything stupid, but again we'd have to be doing something _super_ stupid to hit it. Thanks, Josef
