[report] NULL dereference in __update_reloc_root()

[report] NULL dereference in __update_reloc_root()

[Dan Carpenter]

Hello Btrfs devs,

The patch 5d4f98a28c7d: "Btrfs: Mixed back reference  (FORWARD
ROLLING FORMAT CHANGE)" from Jun 10, 2009, leads to the following
warning:
fs/btrfs/relocation.c:1270 __update_reloc_root()
	 error: potential NULL dereference 'node'.

fs/btrfs/relocation.c
  1255  static int __update_reloc_root(struct btrfs_root *root, int del)
  1256  {
  1257          struct rb_node *rb_node;
  1258          struct mapping_node *node = NULL;
  1259          struct reloc_control *rc = root->fs_info->reloc_ctl;
  1260  
  1261          spin_lock(&rc->reloc_root_tree.lock);
  1262          rb_node = tree_search(&rc->reloc_root_tree.rb_root,
  1263                                root->commit_root->start);
  1264          if (rb_node) {
  1265                  node = rb_entry(rb_node, struct mapping_node, rb_node);
                        ^^^^^^^^^^^^^^^^
Node is only non-NULL if "rb_node" is non-NULL.

  1266                  rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
  1267          }
  1268          spin_unlock(&rc->reloc_root_tree.lock);
  1269  
  1270          BUG_ON((struct btrfs_root *)node->data != root);
                                            ^^^^^^^^^^

Null dereference.

  1271  
  1272          if (!del) {
  1273                  spin_lock(&rc->reloc_root_tree.lock);
  1274                  node->bytenr = root->node->start;
                        ^^^^^^^^^^^^
We assume "node" is non-NULL on this side of the if else statement.

  1275                  rb_node = tree_insert(&rc->reloc_root_tree.rb_root,
  1276                                        node->bytenr, &node->rb_node);
  1277                  spin_unlock(&rc->reloc_root_tree.lock);
  1278                  if (rb_node)
  1279                          backref_tree_panic(rb_node, -EEXIST, node->bytenr);
  1280          } else {
  1281                  spin_lock(&root->fs_info->trans_lock);
  1282                  list_del_init(&root->root_list);
  1283                  spin_unlock(&root->fs_info->trans_lock);
  1284                  kfree(node);
                        ^^^^^^^^^^^
And here as well I guess.

  1285          }
  1286          return 0;

regards,
dan carpenter