From: Filipe Manana Date: Thu, 10 Apr 2025 16:11:14 +0000 (+0100) Subject: btrfs: exit after state insertion failure at btrfs_convert_extent_bit() X-Git-Tag: v6.16-rc1~214^2~68 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3bf179e36da917c5d9bec71c714573ed1649b7c1;p=thirdparty%2Flinux.git btrfs: exit after state insertion failure at btrfs_convert_extent_bit() If insert_state() state failed it returns an error pointer and we call extent_io_tree_panic() which will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then we fallthrough and call cache_state() which will dereference the error pointer, resulting in an invalid memory access. So jump to the 'out' label after calling extent_io_tree_panic(), it also makes the code more clear besides dealing with the exotic scenario where CONFIG_BUG is disabled. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba --- diff --git a/fs/btrfs/extent-io-tree.c b/fs/btrfs/extent-io-tree.c index 0b154f1a3546f..0697afebb71dc 100644 --- a/fs/btrfs/extent-io-tree.c +++ b/fs/btrfs/extent-io-tree.c @@ -1439,6 +1439,7 @@ hit_next: if (IS_ERR(inserted_state)) { ret = PTR_ERR(inserted_state); extent_io_tree_panic(tree, prealloc, "insert", ret); + goto out; } cache_state(inserted_state, cached_state); if (inserted_state == prealloc)