hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

btrfs: Prevent possible ERR_PTR() dereference 

In btrfs_full_stripe_len/btrfs_is_parity_mirror we have similar code which
gets the chunk map for a particular range via get_chunk_map. However,
get_chunk_map can return an ERR_PTR value and while the 2 callers do catch
this with a WARN_ON they then proceed to indiscriminately dereference the
extent map. This of course leads to a crash. Fix the offenders by making the
dereference conditional on IS_ERR.

Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
Nikolay Borisov 2017-07-11 16:55:51 +03:00 committed by David Sterba
parent 1174cade81
commit 69f03f137a
1 changed files with 12 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
fs/btrfs/volumes.c
View File

@ -5173,12 +5173,13 @@ unsigned long btrfs_full_stripe_len(struct btrfs_fs_info *fs_info,
unsigned long len = fs_info->sectorsize; unsigned long len = fs_info->sectorsize;
em = get_chunk_map(fs_info, logical, len); em = get_chunk_map(fs_info, logical, len);
WARN_ON(IS_ERR(em));
map = em->map_lookup; if (!WARN_ON(IS_ERR(em))) {
if (map->type & BTRFS_BLOCK_GROUP_RAID56_MASK) map = em->map_lookup;
len = map->stripe_len * nr_data_stripes(map); if (map->type & BTRFS_BLOCK_GROUP_RAID56_MASK)
free_extent_map(em); len = map->stripe_len * nr_data_stripes(map);
free_extent_map(em);
}
return len; return len;
} }
@ -5190,12 +5191,13 @@ int btrfs_is_parity_mirror(struct btrfs_fs_info *fs_info,
int ret = 0; int ret = 0;
em = get_chunk_map(fs_info, logical, len); em = get_chunk_map(fs_info, logical, len);
WARN_ON(IS_ERR(em));
map = em->map_lookup; if(!WARN_ON(IS_ERR(em))) {
if (map->type & BTRFS_BLOCK_GROUP_RAID56_MASK) map = em->map_lookup;
ret = 1; if (map->type & BTRFS_BLOCK_GROUP_RAID56_MASK)
free_extent_map(em); ret = 1;
free_extent_map(em);
}
return ret; return ret;
} }