From d7210d60b3234034caf653975536a1a74898f2f5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 17 Jan 2021 15:08:27 +0100 Subject: [PATCH] 5.4-stable patches added patches: btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch --- queue-4.14/series | 0 queue-4.19/series | 0 queue-5.10/series | 2 + ...-dereference-in-extent_io_tree_panic.patch | 41 +++++++++++++++++++ queue-5.4/series | 1 + 5 files changed, 44 insertions(+) create mode 100644 queue-4.14/series create mode 100644 queue-4.19/series create mode 100644 queue-5.10/series create mode 100644 queue-5.4/btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..e69de29bb2d diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..e69de29bb2d diff --git a/queue-5.10/series b/queue-5.10/series new file mode 100644 index 00000000000..8d516b0eb12 --- /dev/null +++ b/queue-5.10/series @@ -0,0 +1,2 @@ +btrfs-reloc-fix-wrong-file-extent-type-check-to-avoid-false-enoent.patch +btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch diff --git a/queue-5.4/btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch b/queue-5.4/btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch new file mode 100644 index 00000000000..e8a3e21205b --- /dev/null +++ b/queue-5.4/btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch @@ -0,0 +1,41 @@ +From 29b665cc51e8b602bf2a275734349494776e3dbc Mon Sep 17 00:00:00 2001 +From: Su Yue +Date: Sun, 3 Jan 2021 17:28:03 +0800 +Subject: btrfs: prevent NULL pointer dereference in extent_io_tree_panic + +From: Su Yue + +commit 29b665cc51e8b602bf2a275734349494776e3dbc upstream. + +Some extent io trees are initialized with NULL private member (e.g. +btrfs_device::alloc_state and btrfs_fs_info::excluded_extents). +Dereference of a NULL tree->private as inode pointer will cause panic. + +Pass tree->fs_info as it's known to be valid in all cases. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208929 +Fixes: 05912a3c04eb ("btrfs: drop extent_io_ops::tree_fs_info callback") +CC: stable@vger.kernel.org # 4.19+ +Reviewed-by: Anand Jain +Signed-off-by: Su Yue +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/extent_io.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -647,9 +647,7 @@ alloc_extent_state_atomic(struct extent_ + + static void extent_io_tree_panic(struct extent_io_tree *tree, int err) + { +- struct inode *inode = tree->private_data; +- +- btrfs_panic(btrfs_sb(inode->i_sb), err, ++ btrfs_panic(tree->fs_info, err, + "locking error: extent tree was modified by another thread while locked"); + } + diff --git a/queue-5.4/series b/queue-5.4/series index 7b392891214..094cdeed8b8 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -1 +1,2 @@ kbuild-enforce-werror-return-type.patch +btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch -- 2.47.3