From: Nikolay Borisov Date: Wed, 29 Jun 2016 06:46:41 +0000 (+0300) Subject: btrfs: Handle uninitialised inode eviction X-Git-Tag: v4.8-rc1~38^2~1^2~33 X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=3d48d9810de4ee1bca4a1c905efd0618944904cd;p=karo-tx-linux.git btrfs: Handle uninitialised inode eviction The code flow in btrfs_new_inode allows for btrfs_evict_inode to be called with not fully initialised inode (e.g. ->root member not being set). This can happen when btrfs_set_inode_index in btrfs_new_inode fails, which in turn would call iput for the newly allocated inode. This in turn leads to vfs calling into btrfs_evict_inode. This leads to null pointer dereference. To handle this situation check whether the passed inode has root set and just free it in case it doesn't. Signed-off-by: Nikolay Borisov Reviewed-by: Josef Bacik Signed-off-by: David Sterba --- diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 3e61bd1f3f65..5c2c076bc552 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -5159,11 +5159,18 @@ void btrfs_evict_inode(struct inode *inode) struct btrfs_root *root = BTRFS_I(inode)->root; struct btrfs_block_rsv *rsv, *global_rsv; int steal_from_global = 0; - u64 min_size = btrfs_calc_trunc_metadata_size(root, 1); + u64 min_size; int ret; trace_btrfs_inode_evict(inode); + if (!root) { + kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode)); + return; + } + + min_size = btrfs_calc_trunc_metadata_size(root, 1); + evict_inode_truncate_pages(inode); if (inode->i_nlink &&