diff options
| author | Qu Wenruo <wqu@suse.com> | 2026-08-11 15:31:49 +0930 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2026-09-02 22:19:30 +0200 |
| commit | 0c1032c8c3e9dc8b9a9fa5f6ef23966e236466ed (patch) | |
| tree | 6a1f1bc3b274330112787dbd549a5520f86c1e38 /fs | |
| parent | 2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7 (diff) | |
| download | linux-2.6-0c1032c8c3e9dc8b9a9fa5f6ef23966e236466ed.tar.gz linux-2.6-0c1032c8c3e9dc8b9a9fa5f6ef23966e236466ed.zip | |
btrfs: tests: do not touch page cache if root/inode allocation failed
Inside test_find_delalloc() of extent-io-tests.c, if we fail to allocate
a dummy root or the test inode, we go to out label to clean up.
But at that stage, @inode is still NULL and we will call
process_page_range() to access the page cache of the inode, this will
cause NULL pointer dereference.
This is a very minor bug, as it only affects selftests which are not
compiled in by default for most distros, and very hard to trigger.
Fix it by adding a new out_root_info label to handle root and inode
allocation failure.
This is a pre-existing bug reported by Sashiko while reviewing another
patch.
Link: https://sashiko.dev/#/patchset/cover.1786095309.git.wqu%40suse.com
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/btrfs/tests/extent-io-tests.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/btrfs/tests/extent-io-tests.c b/fs/btrfs/tests/extent-io-tests.c index b2aacf846c8b..23459cd4e503 100644 --- a/fs/btrfs/tests/extent-io-tests.c +++ b/fs/btrfs/tests/extent-io-tests.c @@ -133,14 +133,14 @@ static int test_find_delalloc(u32 sectorsize, u32 nodesize) if (IS_ERR(root)) { test_std_err(TEST_ALLOC_ROOT); ret = PTR_ERR(root); - goto out; + goto out_root_info; } inode = btrfs_new_test_inode(); if (!inode) { test_std_err(TEST_ALLOC_INODE); ret = -ENOMEM; - goto out; + goto out_root_info; } tmp = &BTRFS_I(inode)->io_tree; BTRFS_I(inode)->root = root; @@ -333,6 +333,7 @@ out: process_page_range(inode, 0, total_dirty - 1, PROCESS_UNLOCK | PROCESS_RELEASE); iput(inode); +out_root_info: btrfs_free_dummy_root(root); btrfs_free_dummy_fs_info(fs_info); return ret; |