diff options
| author | Filipe Manana <fdmanana@suse.com> | 2025-04-10 17:11:14 +0100 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2025-05-15 14:30:51 +0200 |
| commit | 3bf179e36da917c5d9bec71c714573ed1649b7c1 (patch) | |
| tree | 85d41b9bb35bc629ed402db90f60646eca001975 /fs/btrfs/extent-io-tree.c | |
| parent | 2a72dd999610f9a8e2ddc0eaaf054cd66e45cde7 (diff) | |
btrfs: exit after state insertion failure at btrfs_convert_extent_bit()
If insert_state() state failed it returns an error pointer and we call
extent_io_tree_panic() which will trigger a BUG() call. However if
CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then
we fallthrough and call cache_state() which will dereference the error
pointer, resulting in an invalid memory access.
So jump to the 'out' label after calling extent_io_tree_panic(), it also
makes the code more clear besides dealing with the exotic scenario where
CONFIG_BUG is disabled.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/btrfs/extent-io-tree.c')
| -rw-r--r-- | fs/btrfs/extent-io-tree.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/btrfs/extent-io-tree.c b/fs/btrfs/extent-io-tree.c index 0b154f1a3546..0697afebb71d 100644 --- a/fs/btrfs/extent-io-tree.c +++ b/fs/btrfs/extent-io-tree.c @@ -1439,6 +1439,7 @@ hit_next: if (IS_ERR(inserted_state)) { ret = PTR_ERR(inserted_state); extent_io_tree_panic(tree, prealloc, "insert", ret); + goto out; } cache_state(inserted_state, cached_state); if (inserted_state == prealloc) |