diff options
| author | Kent Overstreet <kent.overstreet@linux.dev> | 2025-03-31 23:19:04 +0300 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@linux.dev> | 2025-04-01 00:39:27 +0300 |
| commit | de399658588931506e1b3f4cc63cb3c9134a692e (patch) | |
| tree | bc4179f2d29473661cec8b58e2a62a45feba4abf | |
| parent | 7f10fde38f0ac242760e36394e731d25f27e6063 (diff) | |
| download | linux-de399658588931506e1b3f4cc63cb3c9134a692e.tar.xz | |
bcachefs: Fix null ptr deref in bch2_write_endio()
This was previously hard to hit since it requires racing with device
removal, but splitting up io_ref uncovered it.
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
| -rw-r--r-- | fs/bcachefs/io_write.c | 19 |
1 files changed, 13 insertions, 6 deletions
diff --git a/fs/bcachefs/io_write.c b/fs/bcachefs/io_write.c index 07b55839768e..0503ac1952cd 100644 --- a/fs/bcachefs/io_write.c +++ b/fs/bcachefs/io_write.c @@ -697,12 +697,19 @@ static void bch2_write_endio(struct bio *bio) bch2_account_io_completion(ca, BCH_MEMBER_ERROR_write, wbio->submit_time, !bio->bi_status); - if (bio->bi_status) { - bch_err_inum_offset_ratelimited(ca, - op->pos.inode, - wbio->inode_offset << 9, - "data write error: %s", - bch2_blk_status_to_str(bio->bi_status)); + if (unlikely(bio->bi_status)) { + if (ca) + bch_err_inum_offset_ratelimited(ca, + op->pos.inode, + wbio->inode_offset << 9, + "data write error: %s", + bch2_blk_status_to_str(bio->bi_status)); + else + bch_err_inum_offset_ratelimited(c, + op->pos.inode, + wbio->inode_offset << 9, + "data write error: %s", + bch2_blk_status_to_str(bio->bi_status)); set_bit(wbio->dev, op->failed.d); op->flags |= BCH_WRITE_io_error; } |