From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 08943C142 for ; Mon, 19 Jun 2023 10:58:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82319C433C0; Mon, 19 Jun 2023 10:58:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1687172305; bh=Vvji4uh0s4T1YrkOa9+Z9ZOuG3eJAbPAuPjElVTyO2s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OH9g9l1cIxZqH1VeD5OCm82vk36O90iI62v2vzHTtrSqiQWoV8YHozgW+9LcXTDUi AJn2vrkoZ/Ff+si0iprCWCWclBKnYjmn3aJG+F+YYgql0BbyWtBQFXzygroLKgZlpg beoHmvkVAwwJL/fptTPcmVZfjdurX/jcs800I4V4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+d8941552e21eac774778@syzkaller.appspotmail.com, Christoph Hellwig , Anand Jain , Johannes Thumshirn , David Sterba , Sasha Levin Subject: [PATCH 5.15 020/107] btrfs: handle memory allocation failure in btrfs_csum_one_bio Date: Mon, 19 Jun 2023 12:30:04 +0200 Message-ID: <20230619102142.497015478@linuxfoundation.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230619102141.541044823@linuxfoundation.org> References: <20230619102141.541044823@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Johannes Thumshirn [ Upstream commit 806570c0bb7b4847828c22c4934fcf2dc8fc572f ] Since f8a53bb58ec7 ("btrfs: handle checksum generation in the storage layer") the failures of btrfs_csum_one_bio() are handled via bio_end_io(). This means, we can return BLK_STS_RESOURCE from btrfs_csum_one_bio() in case the allocation of the ordered sums fails. This also fixes a syzkaller report, where injecting a failure into the kvzalloc() call results in a BUG_ON(). Reported-by: syzbot+d8941552e21eac774778@syzkaller.appspotmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Anand Jain Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin --- fs/btrfs/file-item.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c index dd8b02a2a14a0..4c210b2ac6994 100644 --- a/fs/btrfs/file-item.c +++ b/fs/btrfs/file-item.c @@ -700,7 +700,9 @@ blk_status_t btrfs_csum_one_bio(struct btrfs_inode *inode, struct bio *bio, sums = kvzalloc(btrfs_ordered_sum_size(fs_info, bytes_left), GFP_KERNEL); memalloc_nofs_restore(nofs_flag); - BUG_ON(!sums); /* -ENOMEM */ + if (!sums) + return BLK_STS_RESOURCE; + sums->len = bytes_left; ordered = btrfs_lookup_ordered_extent(inode, offset); -- 2.39.2