From: Liu Bo <bo.li.liu@oracle.com>
To: linux-btrfs@vger.kernel.org
Cc: David Sterba <dsterba@suse.cz>
Subject: [PATCH] Btrfs: fix Null pointer dereference in dio read endio
Date: Tue, 6 Jun 2017 13:52:52 -0600 [thread overview]
Message-ID: <20170606195252.17563-1-bo.li.liu@oracle.com> (raw)
With switching to use btrfs_bio_clone_partial() to split bio in
directIO path, read endio is also adapted to that by recording a
iterator in btrfs_bio, however, it breaks those bios which are less
than stripe length thus no need to be split and results in NULL
pointer dereference.
This fixes the issue by recording the required bio iterator in
btrfs_bio_clone() which is used to clone non-split bio in directIO
path. It doesn't affect other calls of btrfs_bio_clone() because they
don't need to use this iterator.
This bug was caught by fstests/generic/091.
Cc: David Sterba <dsterba@suse.cz>
Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
Based on David's for-next.
Fixes: commit "Btrfs: change how we iterate bios in endio"
Have run through fstests without introducing new problems.
fs/btrfs/extent_io.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 806e8d6..a91c3a1 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2719,6 +2719,7 @@ struct bio *btrfs_bio_clone(struct bio *bio, gfp_t gfp_mask)
btrfs_bio->csum = NULL;
btrfs_bio->csum_allocated = NULL;
btrfs_bio->end_io = NULL;
+ btrfs_bio->iter = bio->bi_iter;
}
return new;
}
--
2.9.4
next reply other threads:[~2017-06-06 20:53 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-06 19:52 Liu Bo [this message]
2017-06-12 14:09 ` [PATCH] Btrfs: fix Null pointer dereference in dio read endio David Sterba
2017-06-12 14:32 ` David Sterba
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170606195252.17563-1-bo.li.liu@oracle.com \
--to=bo.li.liu@oracle.com \
--cc=dsterba@suse.cz \
--cc=linux-btrfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).