[RESEND PATCH] btrfs: Handle uninitialised inode eviction

[RESEND PATCH] btrfs: Handle uninitialised inode eviction

[Nikolay Borisov]

The code flow in btrfs_new_inode allows for btrfs_evict_inode to be
called with not fully initialised inode (e.g. ->root member not
being set). This can happen when btrfs_set_inode_index in
btrfs_new_inode fails, which in turn would call iput for the newly
allocated inode. This in turn leads to vfs calling into btrfs_evict_inode.
This leads to null pointer dereference. To handle this situation check whether
the passed inode has root set and just free it in case it doesn't.

Signed-off-by: Nikolay Borisov <kernel@kyup.com>
Reviewed-by: Josef Bacik <jbacik@fb.com>
---
 fs/btrfs/inode.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

Hello, 

I belive this is fixes the issue reported in 
http://thread.gmane.org/gmane.comp.file-systems.btrfs/57809

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 4421954720b8..b51723811d01 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5159,11 +5159,18 @@ void btrfs_evict_inode(struct inode *inode)
 	struct btrfs_root *root = BTRFS_I(inode)->root;
 	struct btrfs_block_rsv *rsv, *global_rsv;
 	int steal_from_global = 0;
-	u64 min_size = btrfs_calc_trunc_metadata_size(root, 1);
+	u64 min_size;
 	int ret;
 
 	trace_btrfs_inode_evict(inode);
 
+	if (!root) {
+		kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
+		return;
+	}
+
+	min_size = btrfs_calc_trunc_metadata_size(root, 1);
+
 	evict_inode_truncate_pages(inode);
 
 	if (inode->i_nlink &&
-- 
2.5.0

Re: [RESEND PATCH] btrfs: Handle uninitialised inode eviction

[David Sterba]

On Mon, Jul 11, 2016 at 09:43:09AM +0300, Nikolay Borisov wrote:
> The code flow in btrfs_new_inode allows for btrfs_evict_inode to be
> called with not fully initialised inode (e.g. ->root member not
> being set). This can happen when btrfs_set_inode_index in
> btrfs_new_inode fails, which in turn would call iput for the newly
> allocated inode. This in turn leads to vfs calling into btrfs_evict_inode.
> This leads to null pointer dereference. To handle this situation check whether
> the passed inode has root set and just free it in case it doesn't.
> 
> Signed-off-by: Nikolay Borisov <kernel@kyup.com>
> Reviewed-by: Josef Bacik <jbacik@fb.com>
> ---
>  fs/btrfs/inode.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> Hello, 
> 
> I belive this is fixes the issue reported in 
> http://thread.gmane.org/gmane.comp.file-systems.btrfs/57809

There's some time left before 4.7 release, so I'll send another pull
request, including this patch.

Re: [RESEND PATCH] btrfs: Handle uninitialised inode eviction

[Nikolay Borisov]

On 07/11/2016 11:48 AM, David Sterba wrote:
> On Mon, Jul 11, 2016 at 09:43:09AM +0300, Nikolay Borisov wrote:
>> The code flow in btrfs_new_inode allows for btrfs_evict_inode to be
>> called with not fully initialised inode (e.g. ->root member not
>> being set). This can happen when btrfs_set_inode_index in
>> btrfs_new_inode fails, which in turn would call iput for the newly
>> allocated inode. This in turn leads to vfs calling into btrfs_evict_inode.
>> This leads to null pointer dereference. To handle this situation check whether
>> the passed inode has root set and just free it in case it doesn't.
>>
>> Signed-off-by: Nikolay Borisov <kernel@kyup.com>
>> Reviewed-by: Josef Bacik <jbacik@fb.com>
>> ---
>>  fs/btrfs/inode.c | 9 ++++++++-
>>  1 file changed, 8 insertions(+), 1 deletion(-)
>>
>> Hello, 
>>
>> I belive this is fixes the issue reported in 
>> http://thread.gmane.org/gmane.comp.file-systems.btrfs/57809
> 
> There's some time left before 4.7 release, so I'll send another pull
> request, including this patch.

Now that I think about it, shouldn't this also be queued for stable as well?

Re: [RESEND PATCH] btrfs: Handle uninitialised inode eviction

[David Sterba]

On Mon, Jul 11, 2016 at 01:57:10PM +0300, Nikolay Borisov wrote:
> 
> 
> On 07/11/2016 11:48 AM, David Sterba wrote:
> > On Mon, Jul 11, 2016 at 09:43:09AM +0300, Nikolay Borisov wrote:
> >> The code flow in btrfs_new_inode allows for btrfs_evict_inode to be
> >> called with not fully initialised inode (e.g. ->root member not
> >> being set). This can happen when btrfs_set_inode_index in
> >> btrfs_new_inode fails, which in turn would call iput for the newly
> >> allocated inode. This in turn leads to vfs calling into btrfs_evict_inode.
> >> This leads to null pointer dereference. To handle this situation check whether
> >> the passed inode has root set and just free it in case it doesn't.
> >>
> >> Signed-off-by: Nikolay Borisov <kernel@kyup.com>
> >> Reviewed-by: Josef Bacik <jbacik@fb.com>
> >> ---
> >>  fs/btrfs/inode.c | 9 ++++++++-
> >>  1 file changed, 8 insertions(+), 1 deletion(-)
> >>
> >> Hello, 
> >>
> >> I belive this is fixes the issue reported in 
> >> http://thread.gmane.org/gmane.comp.file-systems.btrfs/57809
> > 
> > There's some time left before 4.7 release, so I'll send another pull
> > request, including this patch.
> 
> Now that I think about it, shouldn't this also be queued for stable as well?

Yes. Marking patches with stable tags has been very inconsistent so we
send patches to stable separately.