From: Zhao Lei Date: Tue, 17 May 2016 09:37:38 +0000 (+0800) Subject: btrfs: scrub: Set bbio to NULL before calling btrfs_map_block X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=f1fee6534dcfbf468a159789aa202db2bce8c200;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git btrfs: scrub: Set bbio to NULL before calling btrfs_map_block We usually call btrfs_put_bbio() when btrfs_map_block() failed, btrfs_put_bbio() works right whether bbio is a valid value, or NULL. But there is a exception, in some case, btrfs_map_block() will return fail without touching *bbio(keeping its original value), and if bbio was not initialized yet, invalid memory accessing will happened. Above case is in scrub_missing_raid56_pages(), and similar case in scrub_raid56_parity(). Signed-off-by: Zhao Lei Signed-off-by: David Sterba --- diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c index fa35cdc46494..ab3b9d604919 100644 --- a/fs/btrfs/scrub.c +++ b/fs/btrfs/scrub.c @@ -2181,7 +2181,7 @@ static void scrub_missing_raid56_pages(struct scrub_block *sblock) struct btrfs_fs_info *fs_info = sctx->dev_root->fs_info; u64 length = sblock->page_count * PAGE_SIZE; u64 logical = sblock->pagev[0]->logical; - struct btrfs_bio *bbio; + struct btrfs_bio *bbio = NULL; struct bio *bio; struct btrfs_raid_bio *rbio; int ret; @@ -2982,6 +2982,7 @@ again: extent_len); mapped_length = extent_len; + bbio = NULL; ret = btrfs_map_block(fs_info, READ, extent_logical, &mapped_length, &bbio, 0); if (!ret) {