Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b8605454 authored by Omar Sandoval's avatar Omar Sandoval Committed by Chris Mason
Browse files

btrfs: check io_ctl_prepare_pages return in __btrfs_write_out_cache 



If io_ctl_prepare_pages fails, the pages in io_ctl.pages are not valid.
When we try to access them later, things will blow up in various ways.

Also fix the comment about the return value, which is an errno on error,
not -1, and update the cases where it was not.

Reviewed-by: default avatarLiu Bo <bo.li.liu@oracle.com>
Signed-off-by: default avatarOmar Sandoval <osandov@osandov.com>
Signed-off-by: default avatarChris Mason <clm@fb.com>
parent 5ca64f45

fs/btrfs/free-space-cache.c

+6 −4
Original line number Original line Diff line number Diff line
@@ -1218,7 +1218,7 @@ out: 
 *

 *

 * This function writes out a free space cache struct to disk for quick recovery

 * This function writes out a free space cache struct to disk for quick recovery

 * on mount.  This will return 0 if it was successfull in writing the cache out,

 * on mount.  This will return 0 if it was successfull in writing the cache out,

 * and -1 if it was not.

 * or an errno if it was not.

 */

 */

static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,

static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,

				   struct btrfs_free_space_ctl *ctl,

				   struct btrfs_free_space_ctl *ctl,
@@ -1235,12 +1235,12 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode, 
	int must_iput = 0;

	int must_iput = 0;





	if (!i_size_read(inode))

	if (!i_size_read(inode))

		return -1;

		return -EIO;





	WARN_ON(io_ctl->pages);

	WARN_ON(io_ctl->pages);

	ret = io_ctl_init(io_ctl, inode, root, 1);

	ret = io_ctl_init(io_ctl, inode, root, 1);

	if (ret)

	if (ret)

		return -1;

		return ret;





	if (block_group && (block_group->flags & BTRFS_BLOCK_GROUP_DATA)) {

	if (block_group && (block_group->flags & BTRFS_BLOCK_GROUP_DATA)) {

		down_write(&block_group->data_rwsem);

		down_write(&block_group->data_rwsem);
@@ -1258,7 +1258,9 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode, 
	}

	}





	/* Lock all pages first so we can lock the extent safely. */

	/* Lock all pages first so we can lock the extent safely. */

	io_ctl_prepare_pages(io_ctl, inode, 0);

	ret = io_ctl_prepare_pages(io_ctl, inode, 0);

	if (ret)

		goto out;





	lock_extent_bits(&BTRFS_I(inode)->io_tree, 0, i_size_read(inode) - 1,

	lock_extent_bits(&BTRFS_I(inode)->io_tree, 0, i_size_read(inode) - 1,

			 0, &cached_state);

			 0, &cached_state);