Btrfs: init relocate extent_io_tree with a mapping (a9995eec) · Commits · 戴 / test

Dave reported a NULL pointer deref. This is caused because he thought he'd be smart and add sanity checks to the extent_io bit operations, but he didn't expect a tree to have a NULL mapping. To fix this we just need to init the relocation's processed_blocks with the btree_inode->i_mapping. Thanks, Reported-by:

David Sterba <dsterba@suse.cz> Signed-off-by:

Josef Bacik <jbacik@fusionio.com> Signed-off-by:

Chris Mason <chris.mason@fusionio.com>

fs/btrfs/relocation.c

+5 −4

Original line number	Diff line number	Diff line
		@@ -4082,7 +4082,7 @@ out:
		return inode;
		}

		static struct reloc_control *alloc_reloc_control(void)
		static struct reloc_control alloc_reloc_control(struct btrfs_fs_info fs_info)
		{
		struct reloc_control *rc;

		@@ -4093,7 +4093,8 @@ static struct reloc_control *alloc_reloc_control(void)
		INIT_LIST_HEAD(&rc->reloc_roots);
		backref_cache_init(&rc->backref_cache);
		mapping_tree_init(&rc->reloc_root_tree);
		extent_io_tree_init(&rc->processed_blocks, NULL);
		extent_io_tree_init(&rc->processed_blocks,
		fs_info->btree_inode->i_mapping);
		return rc;
		}

		@@ -4110,7 +4111,7 @@ int btrfs_relocate_block_group(struct btrfs_root *extent_root, u64 group_start)
		int rw = 0;
		int err = 0;

		rc = alloc_reloc_control();
		rc = alloc_reloc_control(fs_info);
		if (!rc)
		return -ENOMEM;

		@@ -4311,7 +4312,7 @@ int btrfs_recover_relocation(struct btrfs_root *root)
		if (list_empty(&reloc_roots))
		goto out;

		rc = alloc_reloc_control();
		rc = alloc_reloc_control(root->fs_info);
		if (!rc) {
		err = -ENOMEM;
		goto out;

Admin message