| Message ID | 1358609265-347-1-git-send-email-dinggnu@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Sat, Jan 19, 2013 at 08:27:45AM -0700, Cong Ding wrote: > The bug happens when rb_node == NULL. It causes variable node to be NULL and > then the NULL pointer is dereferenced this line: > BUG_ON((struct btrfs_root *)node->data != root); > > Based on my analysis, function tree_search should not return NULL to variable > rb_node in this case (otherwise here has to be something unknown thing wrong), > so I replace "if (rb_node)" with UG_ON(!rb_node). > > Signed-off-by: Cong Ding <dinggnu@gmail.com> I don't want to add more BUG_ON()'s, just return an error. Josef -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index 17c306b..d674671 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -1263,10 +1263,11 @@ static int __update_reloc_root(struct btrfs_root *root, int del) spin_lock(&rc->reloc_root_tree.lock); rb_node = tree_search(&rc->reloc_root_tree.rb_root, root->commit_root->start); - if (rb_node) { - node = rb_entry(rb_node, struct mapping_node, rb_node); - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); - } + BUG_ON(!rb_node); + + node = rb_entry(rb_node, struct mapping_node, rb_node); + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); + spin_unlock(&rc->reloc_root_tree.lock); BUG_ON((struct btrfs_root *)node->data != root);
The bug happens when rb_node == NULL. It causes variable node to be NULL and then the NULL pointer is dereferenced this line: BUG_ON((struct btrfs_root *)node->data != root); Based on my analysis, function tree_search should not return NULL to variable rb_node in this case (otherwise here has to be something unknown thing wrong), so I replace "if (rb_node)" with UG_ON(!rb_node). Signed-off-by: Cong Ding <dinggnu@gmail.com> --- fs/btrfs/relocation.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)