linux-kernel - Re: [PATCH] btrfs: fix NULL pointer dereference in do_abort_log

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAL3q7H5948bcB+keLZnHOJiMBas6k_3cKBdvmReyzgWbBbZwng@mail.gmail.com>
Date: Fri, 19 Dec 2025 18:24:20 +0000
From: Filipe Manana <fdmanana@...nel.org>
To: Suchit Karunakaran <suchitkarunakaran@...il.com>
Cc: clm@...com, dsterba@...e.com, linux-btrfs@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] btrfs: fix NULL pointer dereference in do_abort_log_replay

On Fri, Dec 19, 2025 at 5:18 PM Suchit Karunakaran
<suchitkarunakaran@...il.com> wrote:
>
> Coverity reported a NULL pointer dereference issue (CID 1666756) in
> do_abort_log_replay(). When btrfs_alloc_path() fails in
> replay_one_buffer(), wc->subvol_path is NULL, but btrfs_abort_log_replay()
> calls do_abort_log_replay() which unconditionally dereferences
> wc->subvol_path when attempting to print debug information. Fix this by
> adding a NULL check before dereferencing wc->subvol_path in
> do_abort_log_replay().
>
> Signed-off-by: Suchit Karunakaran <suchitkarunakaran@...il.com>

Reviewed-by: Filipe Manana <fdmanana@...e.com>

Thanks, I'll add it to the for-next github branch with a proper Fixes tag.

> ---
>  fs/btrfs/tree-log.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
> index 5831754bb01c..2d9d38b82daa 100644
> --- a/fs/btrfs/tree-log.c
> +++ b/fs/btrfs/tree-log.c
> @@ -190,7 +190,7 @@ static void do_abort_log_replay(struct walk_control *wc, const char *function,
>
>         btrfs_abort_transaction(wc->trans, error);
>
> -       if (wc->subvol_path->nodes[0]) {
> +       if (wc->subvol_path && wc->subvol_path->nodes[0]) {
>                 btrfs_crit(fs_info,
>                            "subvolume (root %llu) leaf currently being processed:",
>                            btrfs_root_id(wc->root));
> --
> 2.52.0
>
>