From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from userp1040.oracle.com ([156.151.31.81]:24576 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754388Ab3G2NL7 (ORCPT ); Mon, 29 Jul 2013 09:11:59 -0400 Date: Mon, 29 Jul 2013 21:11:43 +0800 From: Liu Bo To: Jan Schmidt Cc: Josef Bacik , linux-btrfs@vger.kernel.org Subject: Re: [PATCH v3] Btrfs: fix crash regarding to ulist_add_merge Message-ID: <20130729131036.GA29613@localhost.localdomain> Reply-To: bo.li.liu@oracle.com References: <1372394265-1959-1-git-send-email-bo.li.liu@oracle.com> <51F62686.7090800@jan-o-sch.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii In-Reply-To: <51F62686.7090800@jan-o-sch.net> Sender: linux-btrfs-owner@vger.kernel.org List-ID: On Mon, Jul 29, 2013 at 10:23:34AM +0200, Jan Schmidt wrote: > On Fri, June 28, 2013 at 06:37 (+0200), Liu Bo wrote: > > Several users reported this crash of NULL pointer or general protection, > > the story is that we add a rbtree for speedup ulist iteration, and we > > use krealloc() to address ulist growth, and krealloc() use memcpy to copy > > old data to new memory area, so it's OK for an array as it doesn't use > > pointers while it's not OK for a rbtree as it uses pointers. > > > > So krealloc() will mess up our rbtree and it ends up with crash. > > > > Reviewed-by: Wang Shilong > > Signed-off-by: Liu Bo > > --- > > v3: fix a return value problem(Thanks Wang Shilong). > > v2: fix an use-after-free bug and a finger error(Thanks Zach and Josef). > > > > fs/btrfs/ulist.c | 15 +++++++++++++++ > > 1 files changed, 15 insertions(+), 0 deletions(-) > > > > diff --git a/fs/btrfs/ulist.c b/fs/btrfs/ulist.c > > index 7b417e2..b0a523b2 100644 > > --- a/fs/btrfs/ulist.c > > +++ b/fs/btrfs/ulist.c > > @@ -205,6 +205,10 @@ int ulist_add_merge(struct ulist *ulist, u64 val, u64 aux, > > u64 new_alloced = ulist->nodes_alloced + 128; > > struct ulist_node *new_nodes; > > void *old = NULL; > > + int i; > > + > > + for (i = 0; i < ulist->nnodes; i++) > > + rb_erase(&ulist->nodes[i].rb_node, &ulist->root); > > > > /* > > * if nodes_alloced == ULIST_SIZE no memory has been allocated > > @@ -224,6 +228,17 @@ int ulist_add_merge(struct ulist *ulist, u64 val, u64 aux, > > > > ulist->nodes = new_nodes; > > ulist->nodes_alloced = new_alloced; > > + > > + /* > > + * krealloc actually uses memcpy, which does not copy rb_node > > + * pointers, so we have to do it ourselves. Otherwise we may > > + * be bitten by crashes. > > + */ > > + for (i = 0; i < ulist->nnodes; i++) { > > + ret = ulist_rbtree_insert(ulist, &ulist->nodes[i]); > > + if (ret < 0) > > + return ret; > > + } > > } > > ulist->nodes[ulist->nnodes].val = val; > > ulist->nodes[ulist->nnodes].aux = aux; > > > > Reviewed-by: Jan Schmidt > > Josef, how about sending this one for the next 3.11 rc and to 3.10 stable? Any > objections? A good candidate for -stable, along with josef's 'last ref' fixes about __tree_mod_log_rewind(), thanks, -liubo