From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753113AbcFFOcv (ORCPT ); Mon, 6 Jun 2016 10:32:51 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:58858 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752602AbcFFOaK (ORCPT ); Mon, 6 Jun 2016 10:30:10 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhao Lei , David Sterba Subject: [PATCH 4.5 127/128] btrfs: scrub: Set bbio to NULL before calling btrfs_map_block Date: Sun, 5 Jun 2016 15:24:42 -0700 Message-Id: <20160605222325.278113643@linuxfoundation.org> X-Mailer: git-send-email 2.8.3 In-Reply-To: <20160605222321.183131188@linuxfoundation.org> References: <20160605222321.183131188@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.5-stable review patch. If anyone has any objections, please let me know. ------------------ From: Zhao Lei commit f1fee6534dcfbf468a159789aa202db2bce8c200 upstream. We usually call btrfs_put_bbio() when btrfs_map_block() failed, btrfs_put_bbio() works right whether bbio is a valid value, or NULL. But there is a exception, in some case, btrfs_map_block() will return fail without touching *bbio(keeping its original value), and if bbio was not initialized yet, invalid memory accessing will happened. Above case is in scrub_missing_raid56_pages(), and similar case in scrub_raid56_parity(). Signed-off-by: Zhao Lei Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/scrub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/btrfs/scrub.c +++ b/fs/btrfs/scrub.c @@ -2179,7 +2179,7 @@ static void scrub_missing_raid56_pages(s struct btrfs_fs_info *fs_info = sctx->dev_root->fs_info; u64 length = sblock->page_count * PAGE_SIZE; u64 logical = sblock->pagev[0]->logical; - struct btrfs_bio *bbio; + struct btrfs_bio *bbio = NULL; struct bio *bio; struct btrfs_raid_bio *rbio; int ret; @@ -2980,6 +2980,7 @@ again: extent_len); mapped_length = extent_len; + bbio = NULL; ret = btrfs_map_block(fs_info, READ, extent_logical, &mapped_length, &bbio, 0); if (!ret) {