Commit 7cad645e authored by Christoph Hellwig's avatar Christoph Hellwig Committed by David Sterba
Browse files

btrfs: fix ordered extent split error handling in btrfs_dio_submit_io 



When the call to btrfs_extract_ordered_extent in btrfs_dio_submit_io
fails to allocate memory for a new ordered_extent, it calls into the
btrfs_dio_end_io for error handling.  btrfs_dio_end_io then assumes that
bbio->ordered is set because it is supposed to be at this point, except
for this error handling corner case.  Try to not overload the
btrfs_dio_end_io with error handling of a bio in a non-canonical state,
and instead call btrfs_finish_ordered_extent and iomap_dio_bio_end_io
directly for this error case.

Reported-by: default avatarsyzbot <syzbot+5b82f0e951f8c2bcdb8f@syzkaller.appspotmail.com>
Fixes: b41b6f69 ("btrfs: use btrfs_finish_ordered_extent to complete direct writes")
Reviewed-by: default avatarJosef Bacik <josef@toxicpanda.com>
Tested-by: default avatarsyzbot <syzbot+5b82f0e951f8c2bcdb8f@syzkaller.appspotmail.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 17b17fcd

fs/btrfs/inode.c

+5 −2
Original line number Diff line number Diff line
@@ -7873,8 +7873,11 @@ static void btrfs_dio_submit_io(const struct iomap_iter *iter, struct bio *bio, 


		ret = btrfs_extract_ordered_extent(bbio, dio_data->ordered);

		if (ret) {

			bbio->bio.bi_status = errno_to_blk_status(ret);

			btrfs_dio_end_io(bbio);

			btrfs_finish_ordered_extent(dio_data->ordered, NULL,

						    file_offset, dip->bytes,

						    !ret);

			bio->bi_status = errno_to_blk_status(ret);

			iomap_dio_bio_end_io(bio);

			return;

		}

	}