Commit bffac4b5 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-5.9-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux 

Pull btrfs fixes from David Sterba:
 "syzkaller started to hit us with reports, here's a fix for one type
  (stack overflow when printing checksums on read error).

  The other patch is a fix for sysfs object, we have a test for that and
  it leads to a crash."

* tag 'for-5.9-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: fix put of uninitialized kobject after seed device delete
  btrfs: fix overflow when copying corrupt csums for a message
parents 79a1971c b5ddcffa

fs/btrfs/disk-io.c

+5 −6
Original line number Diff line number Diff line
@@ -636,16 +636,15 @@ static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio, 
	csum_tree_block(eb, result);



	if (memcmp_extent_buffer(eb, result, 0, csum_size)) {

		u32 val;

		u32 found = 0;



		memcpy(&found, result, csum_size);

		u8 val[BTRFS_CSUM_SIZE] = { 0 };



		read_extent_buffer(eb, &val, 0, csum_size);

		btrfs_warn_rl(fs_info,

		"%s checksum verify failed on %llu wanted %x found %x level %d",

	"%s checksum verify failed on %llu wanted " CSUM_FMT " found " CSUM_FMT " level %d",

			      fs_info->sb->s_id, eb->start,

			      val, found, btrfs_header_level(eb));

			      CSUM_FMT_VALUE(csum_size, val),

			      CSUM_FMT_VALUE(csum_size, result),

			      btrfs_header_level(eb));

		ret = -EUCLEAN;

		goto err;

	}

fs/btrfs/sysfs.c

+10 −6
Original line number Diff line number Diff line
@@ -1170,10 +1170,12 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices, 
					  disk_kobj->name);

		}



		if (one_device->devid_kobj.state_initialized) {

			kobject_del(&one_device->devid_kobj);

			kobject_put(&one_device->devid_kobj);



			wait_for_completion(&one_device->kobj_unregister);

		}



		return 0;

	}
@@ -1186,11 +1188,13 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices, 
			sysfs_remove_link(fs_devices->devices_kobj,

					  disk_kobj->name);

		}

		if (one_device->devid_kobj.state_initialized) {

			kobject_del(&one_device->devid_kobj);

			kobject_put(&one_device->devid_kobj);



			wait_for_completion(&one_device->kobj_unregister);

		}

	}



	return 0;

}