Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-09-21 07:23:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

btrfs: Handle uninitialised inode eviction

Browse Source 
The code flow in btrfs_new_inode allows for btrfs_evict_inode to be
called with not fully initialised inode (e.g. ->root member not
being set). This can happen when btrfs_set_inode_index in
btrfs_new_inode fails, which in turn would call iput for the newly
allocated inode. This in turn leads to vfs calling into btrfs_evict_inode.
This leads to null pointer dereference. To handle this situation check whether
the passed inode has root set and just free it in case it doesn't.

Signed-off-by: Nikolay Borisov <kernel@kyup.com>
Reviewed-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
Nikolay Borisov 2016-06-29 09:46:41 +03:00 committed by David Sterba
parent fb770ae414
commit 3d48d9810d
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
fs/btrfs/inode.c
View File

@ -5159,11 +5159,18 @@ void btrfs_evict_inode(struct inode *inode)
struct btrfs_root *root = BTRFS_I(inode)->root;
struct btrfs_block_rsv *rsv, *global_rsv;
int steal_from_global = 0;
u64 min_size = btrfs_calc_trunc_metadata_size(root, 1);
u64 min_size;
int ret;
trace_btrfs_inode_evict(inode);
if (!root) {
kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
return;
}
min_size = btrfs_calc_trunc_metadata_size(root, 1);
evict_inode_truncate_pages(inode);
if (inode->i_nlink &&