Re: [PATCH] btrfs: inode: Fix NULL pointer dereference if inode doesn't need compression

[David Sterba <dsterba@suse.cz>]

On Tue, Jul 28, 2020 at 09:26:43PM +0800, Qu Wenruo wrote:
> >> Fixes: 4d3a800ebb12 ("btrfs: merge nr_pages input and output parameter in compress_pages")
> > 
> > How does this patch cause the bug?
> > 
> Sorry, I should explain more on that.
> 
> In fact it takes me quite some time to find the proper culprit.
> 
> Before that commit, we have @nr_pages_ret initialized to 0 in
> compress_file_extent().
> 
> If inode_need_compress() returned false in that function, we continue to
> the same inline file extent insert,.
> 
> But in free_pages_out: tag, we use @nr_pages_nr to free pages, which is
> still 0, as it only get initialized to proper values after
> btrfs_compress_pages() call, which we skipped due to
> inode_need_compress() returned false.
> 
> Then free_pages_out: tag will not execute the WARN_ON() and put_pages()
> calls, just skip to kfree(pages). And kfree() can handle NULL pointers
> without any problem.
> 
> Thus a completely sane looking cleanup in fact caused the NULL pointer
> dereference regression for race cases.

Thanks. It was not obvious so I was expecting a bit more convoluted way
to hit the bug.