From patchwork Wed Jun 29 06:46:41 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: kernel@kyup.com X-Patchwork-Id: 9204347 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5047D6075F for ; Wed, 29 Jun 2016 06:47:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3F1E628621 for ; Wed, 29 Jun 2016 06:47:09 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 337A528635; Wed, 29 Jun 2016 06:47:09 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ADBD928621 for ; Wed, 29 Jun 2016 06:47:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751354AbcF2Gqu (ORCPT ); Wed, 29 Jun 2016 02:46:50 -0400 Received: from mail-wm0-f43.google.com ([74.125.82.43]:35620 "EHLO mail-wm0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750790AbcF2Gqs (ORCPT ); Wed, 29 Jun 2016 02:46:48 -0400 Received: by mail-wm0-f43.google.com with SMTP id v199so166572175wmv.0 for ; Tue, 28 Jun 2016 23:46:47 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=VJv6E5KOllqvAsfqfzxgb/qSvYnpj/YR+yXTAh6hKNc=; b=KFUBGNVjUFQLBHZ0uIfvMB4YQD92rZpP5zo+FBH0uxaxMeOBJhLVWF/nsT5cxiJAeH h2HfxI41pz9OtJb61lhYKI59pKjqxpCBzCX6I2it4qZw3BPKpm0Pj8+HHd53HXjzbugy pM6He1pGMCRpRWDyjhCLZQxur3EYcFu+sjir0HS9M/1hqse88QqmtBwS/y1FIjawALNj 1Ksb9d54nnwEcA/h6Jux/n0nD0ybrWnmEvPgPGD/nTcffmANOJZ88m6Bs8O6oKqh7hyv 29htElxKJEVTOpCJT6PyHIlD0jVYW/momNIZNVN4xl59MYyjnR10ZvzN1Yk/h7RNGidj wNAA== X-Gm-Message-State: ALyK8tK41TzAUAZvLwf7varnE0WBZxZnnQGDwzJGWVtNdw1zroWOdjCul81yHHHxAlhc9gvy X-Received: by 10.28.27.212 with SMTP id b203mr7161638wmb.19.1467182806646; Tue, 28 Jun 2016 23:46:46 -0700 (PDT) Received: from localhost.localdomain (admins.1h.com. [82.118.240.130]) by smtp.gmail.com with ESMTPSA id m5sm20567861wmm.10.2016.06.28.23.46.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Jun 2016 23:46:45 -0700 (PDT) From: Nikolay Borisov To: clm@fb.com, jbacik@fb.com, dsterba@suse.com Cc: linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org, operations@siteground.com, Nikolay Borisov Subject: [PATCH] btrfs: Handle uninitialised inode eviction Date: Wed, 29 Jun 2016 09:46:41 +0300 Message-Id: <1467182801-16948-1-git-send-email-kernel@kyup.com> X-Mailer: git-send-email 1.7.1 Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The code flow in btrfs_new_inode allows for btrfs_evict_inode to be called with not fully initialised inode (e.g. ->root member not being set). This can happen when btrfs_set_inode_index in btrfs_new_inode fails, which in turn would call iput for the newly allocated inode. This in turn leads to vfs calling into btrfs_evict_inode. This leads to null pointer dereference. To handle this situation check whether the passed inode has root set and just free it in case it doesn't. Signed-off-by: Nikolay Borisov Reviewed-by: Josef Bacik --- fs/btrfs/inode.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) Hello, I belive this is fixes the issue reported in http://thread.gmane.org/gmane.comp.file-systems.btrfs/57809 diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 4421954720b8..b51723811d01 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -5159,11 +5159,18 @@ void btrfs_evict_inode(struct inode *inode) struct btrfs_root *root = BTRFS_I(inode)->root; struct btrfs_block_rsv *rsv, *global_rsv; int steal_from_global = 0; - u64 min_size = btrfs_calc_trunc_metadata_size(root, 1); + u64 min_size; int ret; trace_btrfs_inode_evict(inode); + if (!root) { + kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode)); + return; + } + + min_size = btrfs_calc_trunc_metadata_size(root, 1); + evict_inode_truncate_pages(inode); if (inode->i_nlink &&