Re: [PATCH] btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized

[Nikolay Borisov <nborisov@suse.com>]

On  2.07.2018 09:25, Qu Wenruo wrote:
> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an
> invalid tree reloc tree can cause kernel NULL pointer dereference when
> btrfs does some cleanup for reloc roots.
> 
> It turns out that fs_info->reloc_ctl can be NULL in
> btrfs_recover_relocation() as we allocate relocation control after all
> reloc roots are verified.
> So when we hit out: tag, we haven't call set_reloc_control() thus
> fs_info->reloc_ctl is still NULL.
> 
> Reported-by: Xu Wen <wen.xu@gatech.edu>
> Signed-off-by: Qu Wenruo <wqu@suse.com>
> ---
>  fs/btrfs/relocation.c | 23 ++++++++++++-----------
>  1 file changed, 12 insertions(+), 11 deletions(-)
> 
> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
> index 879b76fa881a..be94c65bb4d2 100644
> --- a/fs/btrfs/relocation.c
> +++ b/fs/btrfs/relocation.c
> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root)
>  	struct mapping_node *node = NULL;
>  	struct reloc_control *rc = fs_info->reloc_ctl;
>  > -	spin_lock(&rc->reloc_root_tree.lock);
> -	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
> -			      root->node->start);
> -	if (rb_node) {
> -		node = rb_entry(rb_node, struct mapping_node, rb_node);
> -		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);

Just do  if (!rc)
                return;

The function is simple enough, no need to indent multiple lines.
> +	if (rc) {
> +		spin_lock(&rc->reloc_root_tree.lock);
> +		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
> +				      root->node->start);
> +		if (rb_node) {
> +			node = rb_entry(rb_node, struct mapping_node, rb_node);
> +			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
> +		}
> +		spin_unlock(&rc->reloc_root_tree.lock);
> +		if (!node)
> +			return;
> +		BUG_ON((struct btrfs_root *)node->data != root);
>  	}
> -	spin_unlock(&rc->reloc_root_tree.lock);
> -
> -	if (!node)
> -		return;
> -	BUG_ON((struct btrfs_root *)node->data != root);
>  
>  	spin_lock(&fs_info->trans_lock);
>  	list_del_init(&root->root_list);
>