diff options
| author | Lizhi Xu <[email protected]> | 2024-10-25 04:55:53 +0000 |
|---|---|---|
| committer | David Sterba <[email protected]> | 2024-11-29 15:50:40 +0000 |
| commit | 3ed51857a50f530ac7a1482e069dfbd1298558d4 (patch) | |
| tree | 812aa6b57915b14c468728b0a76eaf9042330bdc /security/selinux/hooks.c | |
| parent | btrfs: don't loop for nowait writes when checking for cross references (diff) | |
| download | kernel-3ed51857a50f530ac7a1482e069dfbd1298558d4.tar.gz kernel-3ed51857a50f530ac7a1482e069dfbd1298558d4.zip | |
btrfs: add a sanity check for btrfs root in btrfs_search_slot()
Syzbot reports a null-ptr-deref in btrfs_search_slot().
The reproducer is using rescue=ibadroots, and the extent tree root is
corrupted thus the extent tree is NULL.
When scrub tries to search the extent tree to gather the needed extent
info, btrfs_search_slot() doesn't check if the target root is NULL or
not, resulting the null-ptr-deref.
Add sanity check for btrfs root before using it in btrfs_search_slot().
Reported-by: [email protected]
Fixes: 42437a6386ff ("btrfs: introduce mount option rescue=ignorebadroots")
Link: https://syzkaller.appspot.com/bug?extid=3030e17bd57a73d39bd7
CC: [email protected] # 5.15+
Reviewed-by: Qu Wenruo <[email protected]>
Tested-by: [email protected]
Signed-off-by: Lizhi Xu <[email protected]>
Reviewed-by: David Sterba <[email protected]>
Signed-off-by: David Sterba <[email protected]>
Diffstat (limited to 'security/selinux/hooks.c')
0 files changed, 0 insertions, 0 deletions