Re: [PATCH] btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized

[Qu Wenruo <quwenruo.btrfs@gmx.com>]

On 2018年07月02日 15:31, Nikolay Borisov wrote:
> 
> 
> On  2.07.2018 09:25, Qu Wenruo wrote:
>> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an
>> invalid tree reloc tree can cause kernel NULL pointer dereference when
>> btrfs does some cleanup for reloc roots.
>>
>> It turns out that fs_info->reloc_ctl can be NULL in
>> btrfs_recover_relocation() as we allocate relocation control after all
>> reloc roots are verified.
>> So when we hit out: tag, we haven't call set_reloc_control() thus
>> fs_info->reloc_ctl is still NULL.
>>
>> Reported-by: Xu Wen <wen.xu@gatech.edu>
>> Signed-off-by: Qu Wenruo <wqu@suse.com>
>> ---
>>  fs/btrfs/relocation.c | 23 ++++++++++++-----------
>>  1 file changed, 12 insertions(+), 11 deletions(-)
>>
>> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
>> index 879b76fa881a..be94c65bb4d2 100644
>> --- a/fs/btrfs/relocation.c
>> +++ b/fs/btrfs/relocation.c
>> @@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root)
>>  	struct mapping_node *node = NULL;
>>  	struct reloc_control *rc = fs_info->reloc_ctl;
>>  > -	spin_lock(&rc->reloc_root_tree.lock);
>> -	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
>> -			      root->node->start);
>> -	if (rb_node) {
>> -		node = rb_entry(rb_node, struct mapping_node, rb_node);
>> -		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
> 
> Just do  if (!rc)
>                 return;
> 
> The function is simple enough, no need to indent multiple lines.

You missed serval lines below, we still have:
---
        spin_lock(&fs_info->trans_lock);
        list_del_init(&root->root_list);
        spin_unlock(&fs_info->trans_lock);
        kfree(node);
---

Which still needs to be called even rc is not initialized.

Thanks,
Qu

>> +	if (rc) {
>> +		spin_lock(&rc->reloc_root_tree.lock);
>> +		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
>> +				      root->node->start);
>> +		if (rb_node) {
>> +			node = rb_entry(rb_node, struct mapping_node, rb_node);
>> +			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
>> +		}
>> +		spin_unlock(&rc->reloc_root_tree.lock);
>> +		if (!node)
>> +			return;
>> +		BUG_ON((struct btrfs_root *)node->data != root);
>>  	}
>> -	spin_unlock(&rc->reloc_root_tree.lock);
>> -
>> -	if (!node)
>> -		return;
>> -	BUG_ON((struct btrfs_root *)node->data != root);
>>  
>>  	spin_lock(&fs_info->trans_lock);
>>  	list_del_init(&root->root_list);
>>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>