Filipe Manana
70d1f2b7ec
btrfs: fix NULL pointer dereference after failure to create snapshot
[ Upstream commit 2d892ccdc1 ]
When trying to get a new fs root for a snapshot during the transaction
at transaction.c:create_pending_snapshot(), if btrfs_get_new_fs_root()
fails we leave "pending->snap" pointing to an error pointer, and then
later at ioctl.c:create_snapshot() we dereference that pointer, resulting
in a crash:
[12264.614689] BUG: kernel NULL pointer dereference, address: 00000000000007c4
[12264.615650] #PF: supervisor write access in kernel mode
[12264.616487] #PF: error_code(0x0002) - not-present page
[12264.617436] PGD 0 P4D 0
[12264.618328] Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI
[12264.619150] CPU: 0 PID: 2310635 Comm: fsstress Tainted: G W 5.9.0-rc3-btrfs-next-67 #1
[12264.619960] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[12264.621769] RIP: 0010:btrfs_mksubvol+0x438/0x4a0 [btrfs]
[12264.622528] Code: bc ef ff ff (...)
[12264.624092] RSP: 0018:ffffaa6fc7277cd8 EFLAGS: 00010282
[12264.624669] RAX: 00000000fffffff4 RBX: ffff9d3e8f151a60 RCX: 0000000000000000
[12264.625249] RDX: 0000000000000001 RSI: ffffffff9d56c9be RDI: fffffffffffffff4
[12264.625830] RBP: ffff9d3e8f151b48 R08: 0000000000000000 R09: 0000000000000000
[12264.626413] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffff4
[12264.626994] R13: ffff9d3ede380538 R14: ffff9d3ede380500 R15: ffff9d3f61b2eeb8
[12264.627582] FS: 00007f140d5d8200(0000) GS:ffff9d3fb5e00000(0000) knlGS:0000000000000000
[12264.628176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[12264.628773] CR2: 00000000000007c4 CR3: 000000020f8e8004 CR4: 00000000003706f0
[12264.629379] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[12264.629994] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[12264.630594] Call Trace:
[12264.631227] btrfs_mksnapshot+0x7b/0xb0 [btrfs]
[12264.631840] __btrfs_ioctl_snap_create+0x16f/0x1a0 [btrfs]
[12264.632458] btrfs_ioctl_snap_create_v2+0xb0/0xf0 [btrfs]
[12264.633078] btrfs_ioctl+0x1864/0x3130 [btrfs]
[12264.633689] ? do_sys_openat2+0x1a7/0x2d0
[12264.634295] ? kmem_cache_free+0x147/0x3a0
[12264.634899] ? __x64_sys_ioctl+0x83/0xb0
[12264.635488] __x64_sys_ioctl+0x83/0xb0
[12264.636058] do_syscall_64+0x33/0x80
[12264.636616] entry_SYSCALL_64_after_hwframe+0x44/0xa9
(gdb) list *(btrfs_mksubvol+0x438)
0x7c7b8 is in btrfs_mksubvol (fs/btrfs/ioctl.c:858).
853 ret = 0;
854 pending_snapshot->anon_dev = 0;
855 fail:
856 /* Prevent double freeing of anon_dev */
857 if (ret && pending_snapshot->snap)
858 pending_snapshot->snap->anon_dev = 0;
859 btrfs_put_root(pending_snapshot->snap);
860 btrfs_subvolume_release_metadata(root, &pending_snapshot->block_rsv);
861 free_pending:
862 if (pending_snapshot->anon_dev)
So fix this by setting "pending->snap" to NULL if we get an error from the
call to btrfs_get_new_fs_root() at transaction.c:create_pending_snapshot().
Fixes: 2dfb1e43f5 ("btrfs: preallocate anon block device at first phase of snapshot creation")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-17 13:55:30 +02:00
..
2020-08-19 08:27:03 +02:00
2020-04-20 15:45:22 -06:00
2020-09-09 19:14:29 +02:00
2020-09-09 19:14:14 +02:00
2020-07-08 08:27:56 +02:00
2020-04-20 15:45:22 -06:00
2020-09-17 13:55:30 +02:00
2020-07-08 08:27:56 +02:00
2020-09-09 19:14:10 +02:00
2020-08-21 13:14:53 +02:00
2020-05-05 09:22:21 -06:00
2020-06-01 15:45:27 -07:00
2020-04-20 15:45:22 -06:00
2020-06-01 12:10:17 -07:00
2020-04-27 09:34:55 +02:00
2020-08-19 08:26:56 +02:00
2020-06-01 15:45:27 -07:00
2020-07-09 10:14:29 +03:00
2020-08-19 08:27:06 +02:00
2020-07-21 10:44:19 +09:00
2019-11-11 09:21:59 -05:00
2020-09-09 19:14:24 +02:00
2020-09-03 11:29:37 +02:00
2020-09-03 11:29:20 +02:00
2020-08-26 11:49:07 +02:00
2020-06-03 16:27:18 -07:00
2020-07-15 14:18:20 +02:00
2020-09-09 19:14:09 +02:00
2020-06-02 15:29:19 -07:00
2020-05-22 08:45:46 -06:00
2020-03-29 23:23:00 +02:00
2020-06-06 10:08:17 -07:00
2020-09-03 11:29:22 +02:00
2020-06-13 12:44:30 -07:00
2020-06-02 15:29:19 -07:00
2020-09-03 11:29:30 +02:00
2020-08-26 11:49:06 +02:00
2020-06-02 20:11:35 -07:00
2020-08-19 08:26:35 +02:00
2020-02-04 03:05:26 +00:00
2020-08-21 13:15:18 +02:00
2020-08-21 13:15:18 +02:00
2020-09-03 11:29:26 +02:00
2020-06-10 19:14:17 -07:00
2020-06-14 01:57:21 +09:00
2020-06-14 01:57:21 +09:00
2020-06-02 12:21:36 -07:00
2020-08-21 13:14:58 +02:00
2020-06-02 10:59:07 -07:00
2020-06-05 16:44:36 -07:00
2020-07-16 07:24:47 +02:00
2020-07-03 23:20:14 -07:00
2020-08-19 08:27:02 +02:00
2020-06-02 10:59:07 -07:00
2020-04-27 02:07:40 -04:00
2020-02-07 14:48:37 -05:00
2020-06-04 13:53:10 -07:00
2020-08-26 11:48:59 +02:00
2020-08-26 11:48:59 +02:00
2020-06-05 14:05:57 -07:00
2020-04-20 15:45:22 -06:00
2019-12-10 22:29:58 -05:00
2020-08-21 13:15:13 +02:00
2020-06-02 15:29:19 -07:00
2020-08-21 13:15:18 +02:00
2020-03-25 11:50:48 +01:00
2020-05-07 08:45:47 -06:00
2020-05-12 16:44:00 -07:00
2020-09-09 19:14:25 +02:00
2020-07-20 17:59:31 +09:00
2020-06-15 23:08:25 -05:00
2019-12-08 19:10:50 -05:00
2020-06-03 23:16:55 -04:00
2020-05-07 16:55:47 -05:00
2020-06-10 16:02:54 -07:00
2020-06-10 16:02:54 -07:00
2020-06-04 19:18:29 -07:00
2020-08-27 09:31:49 +02:00
2020-06-04 19:18:29 -07:00
2020-06-04 19:18:29 -07:00
2020-06-18 09:24:35 -06:00
2020-09-03 11:29:31 +02:00
2020-05-14 16:44:23 +02:00
2020-06-05 13:45:21 -07:00
2020-06-09 09:39:14 -07:00
2020-04-02 19:15:03 -07:00
2020-06-03 16:27:18 -07:00
2020-06-14 09:47:25 -07:00
2020-04-27 02:07:40 -04:00
2020-05-06 22:33:43 -04:00
2020-09-09 19:14:21 +02:00
2020-06-09 09:39:14 -07:00
2020-03-03 10:55:06 -05:00
2020-06-29 09:40:55 -07:00
2020-05-19 18:29:36 -04:00
2020-04-10 15:36:22 -07:00
2020-05-14 16:44:25 +02:00
2020-04-02 09:35:26 -07:00
2020-09-03 11:29:42 +02:00
2020-02-07 14:48:35 -05:00
2020-06-05 16:26:36 -07:00
2020-06-05 16:19:28 -07:00
2020-09-12 14:22:12 +02:00
2020-09-03 11:29:43 +02:00
2020-06-15 08:51:38 -06:00
2020-06-03 23:16:55 -04:00
2020-06-14 01:57:21 +09:00
2020-06-14 01:57:21 +09:00
2020-05-22 08:45:46 -06:00
2020-06-11 10:33:13 -07:00
2020-03-05 21:00:40 -05:00
2020-05-14 16:44:24 +02:00
2020-06-02 10:59:07 -07:00
2020-06-08 11:04:19 -07:00
2020-07-14 14:45:41 +02:00
2020-05-13 11:41:22 +02:00
2020-06-02 12:21:36 -07:00
2020-06-13 09:56:21 -07:00
2020-04-27 10:37:14 -04:00
2020-06-08 11:04:19 -07:00
2020-06-04 13:54:34 -07:00
2020-07-08 08:27:57 +02:00
2020-05-01 20:29:54 -04:00
2020-05-29 19:10:42 -04:00
2020-06-04 19:06:25 -07:00
2020-08-26 11:49:07 +02:00
2020-06-13 09:56:21 -07:00
2019-12-08 14:37:36 +01:00
2020-06-02 19:45:12 -07:00
2019-10-03 14:21:35 -07:00
2020-06-10 16:09:11 -07:00
2020-06-09 15:40:50 -07:00
2020-01-14 12:20:53 +01:00
2020-06-09 09:39:14 -07:00
2020-05-14 16:44:24 +02:00
2020-08-11 15:48:10 +02:00