Skip to content

Commit 44ae4b6

Browse files
adam900710kdave
authored andcommitted
btrfs-progs: do not dump leaf if the path is released inside __free_extent()
[BUG] There is a bug report that btrfs-convert crashed during converting an ext4 image which is almost full. [CAUSE] Just before the crash, btrfs-convert is committing the current transaction but failed to locate the backref inside __free_extent(). Then it went through the error handling path, which printed an error message and tried to dump the leaf. But in this particular case, the error code is not -ENOENT, thus the path is already released, resulting path->nodes[0] to be NULL, and btrfs_print_leaf() triggers a NULL pointer dereference. [FIX] The kernel version of btrfs_free_extent() is only dumping the tree for -ENOENT error code. And patch "btrfs: refactor the error handling of __btrfs_free_extent()" was submitted to make abort_and_dump() to only dump the leaf if the path is not released. So follow the same kernel patch, by only dumping the leaf if the path is not released. Issue: #1064 Pull-request: #1065 Signed-off-by: Qu Wenruo <[email protected]> Signed-off-by: David Sterba <[email protected]>
1 parent c8b60ca commit 44ae4b6

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

kernel-shared/extent-tree.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2058,8 +2058,10 @@ static int __free_extent(struct btrfs_trans_handle *trans,
20582058
(unsigned long long)root_objectid,
20592059
(unsigned long long)owner_objectid,
20602060
(unsigned long long)owner_offset);
2061-
printf("path->slots[0]: %d path->nodes[0]:\n", path->slots[0]);
2062-
btrfs_print_leaf(path->nodes[0]);
2061+
if (path->nodes[0]) {
2062+
printf("path->slots[0]: %d path->nodes[0]:\n", path->slots[0]);
2063+
btrfs_print_leaf(path->nodes[0]);
2064+
}
20632065
ret = -EIO;
20642066
goto fail;
20652067
}

0 commit comments

Comments
 (0)