Skip to content

Commit

Permalink
Btrfs: fix crash regarding to ulist_add_merge
Browse files Browse the repository at this point in the history
Several users reported this crash of NULL pointer or general protection,
the story is that we add a rbtree for speedup ulist iteration, and we
use krealloc() to address ulist growth, and krealloc() use memcpy to copy
old data to new memory area, so it's OK for an array as it doesn't use
pointers while it's not OK for a rbtree as it uses pointers.

So krealloc() will mess up our rbtree and it ends up with crash.

Reviewed-by: Wang Shilong <wangsl-fnst@cn.fujitsu.com>
Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
  • Loading branch information
Liu Bo authored and Josef Bacik committed Jul 2, 2013
1 parent edd1400 commit 35f0399
Showing 1 changed file with 15 additions and 0 deletions.
15 changes: 15 additions & 0 deletions fs/btrfs/ulist.c
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,10 @@ int ulist_add_merge(struct ulist *ulist, u64 val, u64 aux,
u64 new_alloced = ulist->nodes_alloced + 128;
struct ulist_node *new_nodes;
void *old = NULL;
int i;

for (i = 0; i < ulist->nnodes; i++)
rb_erase(&ulist->nodes[i].rb_node, &ulist->root);

/*
* if nodes_alloced == ULIST_SIZE no memory has been allocated
Expand All @@ -224,6 +228,17 @@ int ulist_add_merge(struct ulist *ulist, u64 val, u64 aux,

ulist->nodes = new_nodes;
ulist->nodes_alloced = new_alloced;

/*
* krealloc actually uses memcpy, which does not copy rb_node
* pointers, so we have to do it ourselves. Otherwise we may
* be bitten by crashes.
*/
for (i = 0; i < ulist->nnodes; i++) {
ret = ulist_rbtree_insert(ulist, &ulist->nodes[i]);
if (ret < 0)
return ret;
}
}
ulist->nodes[ulist->nnodes].val = val;
ulist->nodes[ulist->nnodes].aux = aux;
Expand Down

0 comments on commit 35f0399

Please sign in to comment.