xfs: fix a null pointer dereference in xfs_bmap_extents_to_btree

Source kernel commit: 01239d77b9dd978863d1a75f0d095ab942a1fe66

Fuzzing tool reports a write to null pointer error in the
xfs_bmap_extents_to_btree, fix it by bailing out on encountering
a null pointer.

Signed-off-by: Shan Hai <shan.hai@oracle.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>

diff --git a/libxfs/xfs_bmap.c b/libxfs/xfs_bmap.c
index 0d24ce6359a5604b5ab8de2fa31355810b1cb0b4..8902ab83491043b9082f32c75bd14e137c975f84 100644 (file)
--- a/libxfs/xfs_bmap.c
+++ b/libxfs/xfs_bmap.c
@@ -703,19 +703,14 @@ xfs_bmap_extents_to_btree(
        args.wasdel = wasdel;
        *logflagsp = 0;
        if ((error = xfs_alloc_vextent(&args))) {
-               xfs_iroot_realloc(ip, -1, whichfork);
                ASSERT(ifp->if_broot == NULL);
-               XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
-               xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
-               return error;
+               goto err1;
        }
 
        if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {
-               xfs_iroot_realloc(ip, -1, whichfork);
                ASSERT(ifp->if_broot == NULL);
-               XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
-               xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
-               return -ENOSPC;
+               error = -ENOSPC;
+               goto err1;
        }
        /*
         * Allocation can't fail, the space was reserved.
@@ -727,6 +722,10 @@ xfs_bmap_extents_to_btree(
        ip->i_d.di_nblocks++;
        xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_BCOUNT, 1L);
        abp = xfs_btree_get_bufl(mp, tp, args.fsbno, 0);
+       if (!abp) {
+               error = -ENOSPC;
+               goto err2;
+       }
        /*
         * Fill in the child block.
         */
@@ -766,6 +765,15 @@ xfs_bmap_extents_to_btree(
        *curp = cur;
        *logflagsp = XFS_ILOG_CORE | xfs_ilog_fbroot(whichfork);
        return 0;
+
+err2:
+       xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_BCOUNT, -1L);
+err1:
+       xfs_iroot_realloc(ip, -1, whichfork);
+       XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
+       xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
+
+       return error;
 }
 
 /*