From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Dan Robertson <dan@dlrobertson.com>,
Nikolay Borisov <nborisov@suse.com>,
David Sterba <dsterba@suse.com>, Sasha Levin <sashal@kernel.org>,
linux-btrfs@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 080/167] btrfs: init csum_list before possible free
Date: Tue, 3 Sep 2019 12:23:52 -0400 [thread overview]
Message-ID: <20190903162519.7136-80-sashal@kernel.org> (raw)
In-Reply-To: <20190903162519.7136-1-sashal@kernel.org>
From: Dan Robertson <dan@dlrobertson.com>
[ Upstream commit e49be14b8d80e23bb7c53d78c21717a474ade76b ]
The scrub_ctx csum_list member must be initialized before scrub_free_ctx
is called. If the csum_list is not initialized beforehand, the
list_empty call in scrub_free_csums will result in a null deref if the
allocation fails in the for loop.
Fixes: a2de733c78fa ("btrfs: scrub")
CC: stable@vger.kernel.org # 3.0+
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Dan Robertson <dan@dlrobertson.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/scrub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index a08a4d6f540f9..916c397704679 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -592,6 +592,7 @@ static noinline_for_stack struct scrub_ctx *scrub_setup_ctx(
sctx->pages_per_rd_bio = SCRUB_PAGES_PER_RD_BIO;
sctx->curr = -1;
sctx->fs_info = fs_info;
+ INIT_LIST_HEAD(&sctx->csum_list);
for (i = 0; i < SCRUB_BIOS_PER_SCTX; ++i) {
struct scrub_bio *sbio;
@@ -616,7 +617,6 @@ static noinline_for_stack struct scrub_ctx *scrub_setup_ctx(
atomic_set(&sctx->workers_pending, 0);
atomic_set(&sctx->cancel_req, 0);
sctx->csum_size = btrfs_super_csum_size(fs_info->super_copy);
- INIT_LIST_HEAD(&sctx->csum_list);
spin_lock_init(&sctx->list_lock);
spin_lock_init(&sctx->stat_lock);
--
2.20.1
next prev parent reply other threads:[~2019-09-03 16:35 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20190903162519.7136-1-sashal@kernel.org>
2019-09-03 16:23 ` [PATCH AUTOSEL 4.19 036/167] Btrfs: clean up scrub is_dev_replace parameter Sasha Levin
2019-09-03 16:23 ` [PATCH AUTOSEL 4.19 037/167] Btrfs: fix deadlock with memory reclaim during scrub Sasha Levin
2019-09-03 16:23 ` [PATCH AUTOSEL 4.19 038/167] btrfs: Remove extent_io_ops::fill_delalloc Sasha Levin
2019-09-03 16:23 ` [PATCH AUTOSEL 4.19 039/167] btrfs: Fix error handling in btrfs_cleanup_ordered_extents Sasha Levin
2019-09-03 16:23 ` [PATCH AUTOSEL 4.19 046/167] btrfs: volumes: Make sure no dev extent is beyond device boundary Sasha Levin
2019-09-03 16:23 ` [PATCH AUTOSEL 4.19 047/167] btrfs: Use real device structure to verify dev extent Sasha Levin
2019-09-03 16:23 ` [PATCH AUTOSEL 4.19 077/167] btrfs: scrub: pass fs_info to scrub_setup_ctx Sasha Levin
2019-09-03 16:23 ` [PATCH AUTOSEL 4.19 078/167] btrfs: scrub: move scrub_setup_ctx allocation out of device_list_mutex Sasha Levin
2019-09-03 16:23 ` [PATCH AUTOSEL 4.19 079/167] btrfs: scrub: fix circular locking dependency warning Sasha Levin
2019-09-03 16:23 ` Sasha Levin [this message]
2019-09-03 16:24 ` [PATCH AUTOSEL 4.19 118/167] Btrfs: fix race between block group removal and block group allocation Sasha Levin
2019-09-03 16:24 ` [PATCH AUTOSEL 4.19 141/167] btrfs: correctly validate compression type Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190903162519.7136-80-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=dan@dlrobertson.com \
--cc=dsterba@suse.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nborisov@suse.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).