From: Filipe Manana Date: Thu, 10 Apr 2025 16:01:59 +0000 (+0100) Subject: btrfs: exit after state split error at btrfs_convert_extent_bit() X-Git-Tag: v6.16-rc1~214^2~69 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2a72dd999610f9a8e2ddc0eaaf054cd66e45cde7;p=thirdparty%2Fkernel%2Flinux.git btrfs: exit after state split error at btrfs_convert_extent_bit() If split_state() returned an error we call extent_io_tree_panic() which will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then we fallthrough and hit a use after free when calling set_state_bits() since the extent state record which the local variable 'prealloc' points to was freed by split_state(). So jump to the label 'out' after calling extent_io_tree_panic() and set the 'prealloc' pointer to NULL since split_state() has already freed it when it hit an error. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba --- diff --git a/fs/btrfs/extent-io-tree.c b/fs/btrfs/extent-io-tree.c index 2c004e0c431d8..0b154f1a3546f 100644 --- a/fs/btrfs/extent-io-tree.c +++ b/fs/btrfs/extent-io-tree.c @@ -1460,8 +1460,11 @@ hit_next: } ret = split_state(tree, state, prealloc, end + 1); - if (ret) + if (ret) { extent_io_tree_panic(tree, state, "split", ret); + prealloc = NULL; + goto out; + } set_state_bits(tree, prealloc, bits, NULL); cache_state(prealloc, cached_state);