From: Eric Sandeen Date: Wed, 18 Oct 2017 18:39:02 +0000 (-0500) Subject: xfs: handle error if xfs_btree_get_bufs fails X-Git-Tag: v4.14.0-rc1~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b2284d05c767d6133407fd5154eae8b6973b4388;p=thirdparty%2Fxfsprogs-dev.git xfs: handle error if xfs_btree_get_bufs fails Source kernel commit: 93e8befc17f6d6ea92b0aee3741ceac8bca4590f Jason reported that a corrupted filesystem failed to replay the log with a metadata block out of bounds warning: XFS (dm-2): _xfs_buf_find: Block out of range: block 0x80270fff8, EOFS 0x9c40000 _xfs_buf_find() and xfs_btree_get_bufs() return NULL if that happens, and then when xfs_alloc_fix_freelist() calls xfs_trans_binval() on that NULL bp, we oops with: BUG: unable to handle kernel NULL pointer dereference at 00000000000000f8 We don't handle _xfs_buf_find errors very well, every caller higher up the stack gets to guess at why it failed. But we should at least handle it somehow, so return EFSCORRUPTED here. Reported-by: Jason L Tibbitts III Signed-off-by: Eric Sandeen Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Eric Sandeen --- diff --git a/libxfs/xfs_alloc.c b/libxfs/xfs_alloc.c index 36a380a57..4bd11d3d3 100644 --- a/libxfs/xfs_alloc.c +++ b/libxfs/xfs_alloc.c @@ -1580,6 +1580,10 @@ xfs_alloc_ag_vextent_small( bp = xfs_btree_get_bufs(args->mp, args->tp, args->agno, fbno, 0); + if (!bp) { + error = -EFSCORRUPTED; + goto error0; + } xfs_trans_binval(args->tp, bp); } args->len = 1; @@ -2137,6 +2141,10 @@ xfs_alloc_fix_freelist( if (error) goto out_agbp_relse; bp = xfs_btree_get_bufs(mp, tp, args->agno, bno, 0); + if (!bp) { + error = -EFSCORRUPTED; + goto out_agbp_relse; + } xfs_trans_binval(tp, bp); }