diff options
author | Anand Jain <anand.jain@oracle.com> | 2020-09-04 20:34:21 +0300 |
---|---|---|
committer | David Sterba <dsterba@suse.com> | 2020-09-22 16:57:52 +0300 |
commit | b5ddcffa37778244d5e786fe32f778edf2bfc93e (patch) | |
tree | 2d27703d4fe628cc317f5f308d643f3a74e0c861 /fs/btrfs/dev-replace.c | |
parent | 35be8851d172c6e3db836c0f28c19087b10c9e00 (diff) | |
download | linux-b5ddcffa37778244d5e786fe32f778edf2bfc93e.tar.xz |
btrfs: fix put of uninitialized kobject after seed device delete
The following test case leads to NULL kobject free error:
mount seed /mnt
add sprout to /mnt
umount /mnt
mount sprout to /mnt
delete seed
kobject: '(null)' (00000000dd2b87e4): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 1 PID: 15784 at lib/kobject.c:736 kobject_put+0x80/0x350
RIP: 0010:kobject_put+0x80/0x350
::
Call Trace:
btrfs_sysfs_remove_devices_dir+0x6e/0x160 [btrfs]
btrfs_rm_device.cold+0xa8/0x298 [btrfs]
btrfs_ioctl+0x206c/0x22a0 [btrfs]
ksys_ioctl+0xe2/0x140
__x64_sys_ioctl+0x1e/0x29
do_syscall_64+0x96/0x150
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f4047c6288b
::
This is because, at the end of the seed device-delete, we try to remove
the seed's devid sysfs entry. But for the seed devices under the sprout
fs, we don't initialize the devid kobject yet. So add a kobject state
check, which takes care of the bug.
Fixes: 668e48af7a94 ("btrfs: sysfs, add devid/dev_state kobject and device attributes")
CC: stable@vger.kernel.org # 5.6+
Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/btrfs/dev-replace.c')
0 files changed, 0 insertions, 0 deletions