Commit 92cc6d50 authored by Josef Bacik's avatar Josef Bacik Committed by Long Li
Browse files

btrfs: handle errors from btrfs_dec_ref() properly 

mainline inclusion
from mainline-v6.10-rc2
commit 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYDJ
CVE: CVE-2024-46753

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5eb178f373b4f16f3b42d55ff88fc94dd95b93b1



--------------------------------

In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref().  This is
incorrect, we have proper error handling here, return the error.

Signed-off-by: default avatarJosef Bacik <josef@toxicpanda.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
Conflicts:
	fs/btrfs/extent-tree.c
[Conflict due to not merge mainline commit e094f48040cd]
Signed-off-by: default avatarLong Li <leo.lilong@huawei.com>
parent 2e95e7ba

fs/btrfs/extent-tree.c

+4 −1
Original line number Diff line number Diff line
@@ -5518,7 +5518,10 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, 
				ret = btrfs_dec_ref(trans, root, eb, 1);

			else

				ret = btrfs_dec_ref(trans, root, eb, 0);

			BUG_ON(ret); /* -ENOMEM */

			if (ret) {

				btrfs_abort_transaction(trans, ret);

				return ret;

			}

			if (is_fstree(root->root_key.objectid)) {

				ret = btrfs_qgroup_trace_leaf_items(trans, eb);

				if (ret) {