Commit 80c0b421 authored Apr 03, 2018 by Liu Bo Committed by David Sterba Apr 05, 2018

Btrfs: fix NULL pointer dereference in log_dir_items



0, 1 and <0 can be returned by btrfs_next_leaf(), and when <0 is
returned, path->nodes[0] could be NULL, log_dir_items lacks such a
check for <0 and we may run into a null pointer dereference panic.

Fixes: e02119d5 ("Btrfs: Add a write ahead tree log to optimize synchronous operations")
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>
Signed-off-by: David Sterba <dsterba@suse.com>

parent 57599c7e

fs/btrfs/tree-log.c

+5 −2

Original line number	Original line	Diff line number	Diff line
	@@ -3520,8 +3520,11 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans,
	* from this directory and from this transaction		* from this directory and from this transaction
	*/		*/
	ret = btrfs_next_leaf(root, path);		ret = btrfs_next_leaf(root, path);
	if (ret == 1) {		if (ret) {
			if (ret == 1)
	last_offset = (u64)-1;		last_offset = (u64)-1;
			else
			err = ret;
	goto done;		goto done;
	}		}
	btrfs_item_key_to_cpu(path->nodes[0], &tmp, path->slots[0]);		btrfs_item_key_to_cpu(path->nodes[0], &tmp, path->slots[0]);

Admin message