tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()

Browse Source 
BugLink: https://bugs.launchpad.net/bugs/2085849

[ Upstream commit 28cb13f29faf6290597b24b728dc3100c019356f ]

Instead of doing a BUG_ON() handle the error by returning -EUCLEAN,
aborting the transaction and logging an error message.

Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
CVE-2024-46751
Signed-off-by: Manuel Diewald <manuel.diewald@canonical.com>
Signed-off-by: Roxana Nicolescu <roxana.nicolescu@canonical.com>
This commit is contained in:
Filipe Manana
2024-06-18 12:15:01 +01:00
committed by Mehmet Basaran
parent 277173b1d3
commit 4641a74599
1 changed files with 20 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/btrfs/extent-tree.c
+20 -4
View File
@@ -178,9 +178,16 @@ search_again:
ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
num_refs = btrfs_extent_refs(leaf, ei);
if (unlikely(num_refs == 0)) {
ret = -EUCLEAN;
btrfs_err(fs_info,
"unexpected zero reference count for extent item (%llu %u %llu)",
key.objectid, key.type, key.offset);
btrfs_abort_transaction(trans, ret);
goto out_free;
}
extent_flags = btrfs_extent_flags(leaf, ei);
owner = btrfs_get_extent_owner_root(fs_info, leaf, path->slots[0]);
BUG_ON(num_refs == 0);
} else {
num_refs = 0;
extent_flags = 0;
@@ -210,10 +217,19 @@ search_again:
goto search_again;
}
spin_lock(&head->lock);
if (head->extent_op && head->extent_op->update_flags)
if (head->extent_op && head->extent_op->update_flags) {
extent_flags |= head->extent_op->flags_to_set;
else
BUG_ON(num_refs == 0);
} else if (unlikely(num_refs == 0)) {
spin_unlock(&head->lock);
mutex_unlock(&head->mutex);
spin_unlock(&delayed_refs->lock);
ret = -EUCLEAN;
btrfs_err(fs_info,
"unexpected zero reference count for extent %llu (%s)",
bytenr, metadata ? "metadata" : "data");
btrfs_abort_transaction(trans, ret);
goto out_free;
}
num_refs += head->ref_mod;
spin_unlock(&head->lock);