Re: [PATCH] btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized

From: David Sterba <dsterba@suse.cz>
To: Qu Wenruo <wqu@suse.com>
Cc: linux-btrfs@vger.kernel.org
Subject: Re: [PATCH] btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized
Date: Mon, 2 Jul 2018 17:58:59 +0200	[thread overview]
Message-ID: <20180702155859.GC3126@twin.jikos.cz> (raw)
In-Reply-To: <20180702062538.30794-1-wqu@suse.com>

On Mon, Jul 02, 2018 at 02:25:38PM +0800, Qu Wenruo wrote:
> Reported in https://bugzilla.kernel.org/show_bug.cgi?id=199833, where an
> invalid tree reloc tree can cause kernel NULL pointer dereference when
> btrfs does some cleanup for reloc roots.
> 
> It turns out that fs_info->reloc_ctl can be NULL in
> btrfs_recover_relocation() as we allocate relocation control after all
> reloc roots are verified.
> So when we hit out: tag, we haven't call set_reloc_control() thus
> fs_info->reloc_ctl is still NULL.
> 
> Reported-by: Xu Wen <wen.xu@gatech.edu>
> Signed-off-by: Qu Wenruo <wqu@suse.com>

Thanks for the fix, patch added to the queue. I've added the fuzzed
image from bugzilla to btrfs-progs.