[PATCH] btrfs: tests: do not touch page cache if root/inode allocation failed

[PATCH] btrfs: tests: do not touch page cache if root/inode allocation failed

[Qu Wenruo]

Inside test_find_delalloc() of extent-io-tests.c, if we failed to
allocate a dummy root or the test inode, we goto out label to clean up.

But at that stage, @inode is still NULL and we will call
process_page_range() to access the page cache of the inode, this will
cause NULL pointer dereference.

This is a very minor bug, as it only affects selftests which are not
compiled in by default for most distros, and very hard to trigger.

Fix it by adding a new out_root_info label to handle root and inode
allocation failure.

This is a pre-existing bug reported by Sashiko while reviewing another
patch.

Link: https://sashiko.dev/#/patchset/cover.1786095309.git.wqu%40suse.com
Signed-off-by: Qu Wenruo <wqu@suse.com>
---
 fs/btrfs/tests/extent-io-tests.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/tests/extent-io-tests.c b/fs/btrfs/tests/extent-io-tests.c
index b2aacf846c8b..23459cd4e503 100644
--- a/fs/btrfs/tests/extent-io-tests.c
+++ b/fs/btrfs/tests/extent-io-tests.c
@@ -133,14 +133,14 @@ static int test_find_delalloc(u32 sectorsize, u32 nodesize)
 	if (IS_ERR(root)) {
 		test_std_err(TEST_ALLOC_ROOT);
 		ret = PTR_ERR(root);
-		goto out;
+		goto out_root_info;
 	}
 
 	inode = btrfs_new_test_inode();
 	if (!inode) {
 		test_std_err(TEST_ALLOC_INODE);
 		ret = -ENOMEM;
-		goto out;
+		goto out_root_info;
 	}
 	tmp = &BTRFS_I(inode)->io_tree;
 	BTRFS_I(inode)->root = root;
@@ -333,6 +333,7 @@ static int test_find_delalloc(u32 sectorsize, u32 nodesize)
 	process_page_range(inode, 0, total_dirty - 1,
 			   PROCESS_UNLOCK | PROCESS_RELEASE);
 	iput(inode);
+out_root_info:
 	btrfs_free_dummy_root(root);
 	btrfs_free_dummy_fs_info(fs_info);
 	return ret;
-- 
2.54.0

Re: [PATCH] btrfs: tests: do not touch page cache if root/inode allocation failed

[Boris Burkov]

On Tue, Aug 11, 2026 at 03:31:49PM +0930, Qu Wenruo wrote:
> Inside test_find_delalloc() of extent-io-tests.c, if we failed to
> allocate a dummy root or the test inode, we goto out label to clean up.
> 
> But at that stage, @inode is still NULL and we will call
> process_page_range() to access the page cache of the inode, this will
> cause NULL pointer dereference.
> 
> This is a very minor bug, as it only affects selftests which are not
> compiled in by default for most distros, and very hard to trigger.
> 
> Fix it by adding a new out_root_info label to handle root and inode
> allocation failure.
> 
> This is a pre-existing bug reported by Sashiko while reviewing another
> patch.
> 
> Link: https://sashiko.dev/#/patchset/cover.1786095309.git.wqu%40suse.com
> Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Boris Burkov <boris@bur.io>
> ---
>  fs/btrfs/tests/extent-io-tests.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/btrfs/tests/extent-io-tests.c b/fs/btrfs/tests/extent-io-tests.c
> index b2aacf846c8b..23459cd4e503 100644
> --- a/fs/btrfs/tests/extent-io-tests.c
> +++ b/fs/btrfs/tests/extent-io-tests.c
> @@ -133,14 +133,14 @@ static int test_find_delalloc(u32 sectorsize, u32 nodesize)
>  	if (IS_ERR(root)) {
>  		test_std_err(TEST_ALLOC_ROOT);
>  		ret = PTR_ERR(root);
> -		goto out;
> +		goto out_root_info;
>  	}
>  
>  	inode = btrfs_new_test_inode();
>  	if (!inode) {
>  		test_std_err(TEST_ALLOC_INODE);
>  		ret = -ENOMEM;
> -		goto out;
> +		goto out_root_info;
>  	}
>  	tmp = &BTRFS_I(inode)->io_tree;
>  	BTRFS_I(inode)->root = root;
> @@ -333,6 +333,7 @@ static int test_find_delalloc(u32 sectorsize, u32 nodesize)
>  	process_page_range(inode, 0, total_dirty - 1,
>  			   PROCESS_UNLOCK | PROCESS_RELEASE);
>  	iput(inode);
> +out_root_info:
>  	btrfs_free_dummy_root(root);
>  	btrfs_free_dummy_fs_info(fs_info);
>  	return ret;
> -- 
> 2.54.0
>