Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 69f03f13 authored by Nikolay Borisov's avatar Nikolay Borisov Committed by David Sterba
Browse files

btrfs: Prevent possible ERR_PTR() dereference 



In btrfs_full_stripe_len/btrfs_is_parity_mirror we have similar code which
gets the chunk map for a particular range via get_chunk_map. However,
get_chunk_map can return an ERR_PTR value and while the 2 callers do catch
this with a WARN_ON they then proceed to indiscriminately dereference the
extent map. This of course leads to a crash. Fix the offenders by making the
dereference conditional on IS_ERR.

Signed-off-by: default avatarNikolay Borisov <nborisov@suse.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 1174cade

fs/btrfs/volumes.c

+12 −10
Original line number Diff line number Diff line
@@ -5173,12 +5173,13 @@ unsigned long btrfs_full_stripe_len(struct btrfs_fs_info *fs_info, 
	unsigned long len = fs_info->sectorsize;



	em = get_chunk_map(fs_info, logical, len);

	WARN_ON(IS_ERR(em));



	if (!WARN_ON(IS_ERR(em))) {

		map = em->map_lookup;

		if (map->type & BTRFS_BLOCK_GROUP_RAID56_MASK)

			len = map->stripe_len * nr_data_stripes(map);

		free_extent_map(em);

	}

	return len;

}
@@ -5190,12 +5191,13 @@ int btrfs_is_parity_mirror(struct btrfs_fs_info *fs_info, 
	int ret = 0;



	em = get_chunk_map(fs_info, logical, len);

	WARN_ON(IS_ERR(em));



	if(!WARN_ON(IS_ERR(em))) {

		map = em->map_lookup;

		if (map->type & BTRFS_BLOCK_GROUP_RAID56_MASK)

			ret = 1;

		free_extent_map(em);

	}

	return ret;

}