linux-kernel - [PATCH v3] fs/btrfs: avoid null pointer dereference if reloc control has not been initialized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1609852978-2463334-1-git-send-email-bodefang@126.com>
Date:   Tue,  5 Jan 2021 21:22:58 +0800
From:   Defang Bo <bodefang@....com>
To:     clm@...com, josef@...icpanda.com, dsterba@...e.com
Cc:     linux-btrfs@...r.kernel.or, linux-kernel@...r.kernel.org,
        Defang Bo <bodefang@....com>
Subject: [PATCH v3] fs/btrfs: avoid null pointer dereference if reloc control has not been initialized

Similar to commmit<389305b2aa68>("btrfs: relocation: Only remove reloc rb_trees if
reloc control has been initialized"). It turns out that fs_info::reloc_ctl can be NULL
in btrfs_recover_relocation(), as we allocate relocation control after all reloc roots
have been verified,so there should be a check for rc to prevent null pointer dereference.

......
Signed-off-by: Defang Bo <bodefang@....com>
---
Changes since v2:
- Resend this patch with manual reformatted.

Changes singe v1:
- More accurate description for this patch to describe how the NULL can get there.
---
......
---
 fs/btrfs/relocation.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 3602806d71bd..ca035712e08b 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -626,6 +626,9 @@ static int __must_check __add_reloc_root(struct btrfs_root *root)
 	struct mapping_node *node;
 	struct reloc_control *rc = fs_info->reloc_ctl;
 
+	if (!rc)
+		return 0;
+
 	node = kmalloc(sizeof(*node), GFP_NOFS);
 	if (!node)
 		return -ENOMEM;
@@ -703,6 +706,9 @@ static int __update_reloc_root(struct btrfs_root *root)
 	struct rb_node *rb_node;
 	struct mapping_node *node = NULL;
 	struct reloc_control *rc = fs_info->reloc_ctl;
+
+	if (!rc)
+		return 0;
 
 	spin_lock(&rc->reloc_root_tree.lock);
 	rb_node = rb_simple_search(&rc->reloc_root_tree.rb_root,
-- 
2.7.4