Commit 3d48d981 authored Jun 29, 2016 by Nikolay Borisov Committed by David Sterba Jul 26, 2016

btrfs: Handle uninitialised inode eviction



The code flow in btrfs_new_inode allows for btrfs_evict_inode to be
called with not fully initialised inode (e.g. ->root member not
being set). This can happen when btrfs_set_inode_index in
btrfs_new_inode fails, which in turn would call iput for the newly
allocated inode. This in turn leads to vfs calling into btrfs_evict_inode.
This leads to null pointer dereference. To handle this situation check whether
the passed inode has root set and just free it in case it doesn't.

Signed-off-by: Nikolay Borisov <kernel@kyup.com>
Reviewed-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: David Sterba <dsterba@suse.com>

parent fb770ae4

fs/btrfs/inode.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -5159,11 +5159,18 @@ void btrfs_evict_inode(struct inode *inode)
		struct btrfs_root *root = BTRFS_I(inode)->root;
		struct btrfs_block_rsv rsv, global_rsv;
		int steal_from_global = 0;
		u64 min_size = btrfs_calc_trunc_metadata_size(root, 1);
		u64 min_size;
		int ret;

		trace_btrfs_inode_evict(inode);

		if (!root) {
		kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
		return;
		}

		min_size = btrfs_calc_trunc_metadata_size(root, 1);

		evict_inode_truncate_pages(inode);

		if (inode->i_nlink &&