Dmitriy Gorokh e625797168 btrfs: Fix NULL pointer exception in find_bio_stripe ... commit 047fdea634 upstream. On detaching of a disk which is a part of a RAID6 filesystem, the following kernel OOPS may happen: [63122.680461] BTRFS error (device sdo): bdev /dev/sdo errs: wr 0, rd 0, flush 1, corrupt 0, gen 0 [63122.719584] BTRFS warning (device sdo): lost page write due to IO error on /dev/sdo [63122.719587] BTRFS error (device sdo): bdev /dev/sdo errs: wr 1, rd 0, flush 1, corrupt 0, gen 0 [63122.803516] BTRFS warning (device sdo): lost page write due to IO error on /dev/sdo [63122.803519] BTRFS error (device sdo): bdev /dev/sdo errs: wr 2, rd 0, flush 1, corrupt 0, gen 0 [63122.863902] BTRFS critical (device sdo): fatal error on device /dev/sdo [63122.935338] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 [63122.946554] IP: fail_bio_stripe+0x58/0xa0 [btrfs] [63122.958185] PGD 9ecda067 P4D 9ecda067 PUD b2b37067 PMD 0 [63122.971202] Oops: 0000 [#1] SMP [63123.006760] CPU: 0 PID: 3979 Comm: kworker/u8:9 Tainted: G W 4.14.2-16-scst34x+ #8 [63123.007091] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [63123.007402] Workqueue: btrfs-worker btrfs_worker_helper [btrfs] [63123.007595] task: ffff880036ea4040 task.stack: ffffc90006384000 [63123.007796] RIP: 0010:fail_bio_stripe+0x58/0xa0 [btrfs] [63123.007968] RSP: 0018:ffffc90006387ad8 EFLAGS: 00010287 [63123.008140] RAX: 0000000000000002 RBX: ffff88004beaa0b8 RCX: ffff8800b2bd5690 [63123.008359] RDX: 0000000000000000 RSI: ffff88007bb43500 RDI: ffff88004beaa000 [63123.008621] RBP: ffffc90006387ae8 R08: 0000000099100000 R09: ffff8800b2bd5600 [63123.008840] R10: 0000000000000004 R11: 0000000000010000 R12: ffff88007bb43500 [63123.009059] R13: 00000000fffffffb R14: ffff880036fc5180 R15: 0000000000000004 [63123.009278] FS: 0000000000000000(0000) GS:ffff8800b7000000(0000) knlGS:0000000000000000 [63123.009564] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [63123.009748] CR2: 0000000000000080 CR3: 00000000b0866000 CR4: 00000000000406f0 [63123.009969] Call Trace: [63123.010085] raid_write_end_io+0x7e/0x80 [btrfs] [63123.010251] bio_endio+0xa1/0x120 [63123.010378] generic_make_request+0x218/0x270 [63123.010921] submit_bio+0x66/0x130 [63123.011073] finish_rmw+0x3fc/0x5b0 [btrfs] [63123.011245] full_stripe_write+0x96/0xc0 [btrfs] [63123.011428] raid56_parity_write+0x117/0x170 [btrfs] [63123.011604] btrfs_map_bio+0x2ec/0x320 [btrfs] [63123.011759] ? ___cache_free+0x1c5/0x300 [63123.011909] __btrfs_submit_bio_done+0x26/0x50 [btrfs] [63123.012087] run_one_async_done+0x9c/0xc0 [btrfs] [63123.012257] normal_work_helper+0x19e/0x300 [btrfs] [63123.012429] btrfs_worker_helper+0x12/0x20 [btrfs] [63123.012656] process_one_work+0x14d/0x350 [63123.012888] worker_thread+0x4d/0x3a0 [63123.013026] ? _raw_spin_unlock_irqrestore+0x15/0x20 [63123.013192] kthread+0x109/0x140 [63123.013315] ? process_scheduled_works+0x40/0x40 [63123.013472] ? kthread_stop+0x110/0x110 [63123.013610] ret_from_fork+0x25/0x30 [63123.014469] RIP: fail_bio_stripe+0x58/0xa0 [btrfs] RSP: ffffc90006387ad8 [63123.014678] CR2: 0000000000000080 [63123.016590] ---[ end trace a295ea7259c17880 ]— This is reproducible in a cycle, where a series of writes is followed by SCSI device delete command. The test may take up to few minutes. Fixes: 74d46992e0 ("block: replace bi_bdev with a gendisk pointer and partitions index") [ no signed-off-by provided ] Author: Dmitriy Gorokh <Dmitriy.Gorokh@wdc.com> Reviewed-by: Liu Bo <bo.li.liu@oracle.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-03-21 12:06:44 +01:00
..
tests	btrfs: tests: Fix a memory leak in error handling path in 'run_test()'	2017-12-20 10:10:30 +01:00
acl.c	btrfs: preserve i_mode if __btrfs_set_acl() fails	2017-08-21 17:47:42 +02:00
async-thread.c	btrfs: constify tracepoint arguments	2017-08-16 14:19:53 +02:00
async-thread.h	btrfs: constify tracepoint arguments	2017-08-16 14:19:53 +02:00
backref.c	Btrfs: convert to use btrfs_get_extent_inline_ref_type	2017-08-21 17:47:43 +02:00
backref.h	btrfs: backref, add tracepoints for prelim_ref insertion and merging	2017-08-16 16:12:01 +02:00
btrfs_inode.h	btrfs: separate defrag and property compression	2017-08-16 16:12:05 +02:00
check-integrity.c	Merge branch 'for-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux	2017-09-09 13:27:51 -07:00
check-integrity.h	btrfs: take an fs_info directly when the root is not used otherwise	2016-12-06 16:06:59 +01:00
compression.c	Merge branch 'for-4.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux	2017-09-29 12:57:35 -07:00
compression.h	Merge branch 'zstd-minimal' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2017-09-14 17:30:49 -07:00
ctree.c	btrfs: handle errors while updating refcounts in update_ref_for_cow	2017-12-14 09:52:54 +01:00
ctree.h	Merge branch 'for-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux	2017-10-06 09:03:08 -07:00
dedupe.h	btrfs: expand cow_file_range() to support in-band dedup and subpage-blocksize	2016-07-26 13:52:25 +02:00
delayed-inode.c	Btrfs: fix stale entries in readdir	2018-01-31 14:03:42 +01:00
delayed-inode.h	btrfs: convert btrfs_delayed_item.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
delayed-ref.c	Btrfs: return old and new total ref mods when adding delayed refs	2017-06-29 20:17:01 +02:00
delayed-ref.h	Btrfs: return old and new total ref mods when adding delayed refs	2017-06-29 20:17:01 +02:00
dev-replace.c	Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-09-14 18:54:01 -07:00
dev-replace.h	btrfs: constify device path passed to relevant helpers	2017-02-28 14:26:07 +01:00
dir-item.c	btrfs: fix validation of XATTR_ITEM dir items	2017-06-29 20:06:11 +02:00
disk-io.c	Btrfs: disable FUA if mounted with nobarrier	2018-02-25 11:08:00 +01:00
disk-io.h	btrfs: use named constant for bdev blocksize	2017-08-16 16:12:04 +02:00
export.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
export.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
extent-tree.c	btrfs: fix missing error return in btrfs_drop_snapshot	2017-12-14 09:52:54 +01:00
extent_io.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
extent_io.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
extent_map.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
extent_map.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
file-item.c	Merge branch 'for-4.13-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux	2017-07-05 16:41:23 -07:00
file.c	Btrfs: fix list_add corruption and soft lockups in fsync	2018-02-03 17:39:06 +01:00
free-space-cache.c	btrfs: fix deadlock when writing out space cache	2018-02-03 17:39:04 +01:00
free-space-cache.h	btrfs: free-space-cache, clean up unnecessary root arguments	2017-02-17 12:03:56 +01:00
free-space-tree.c	btrfs: pass fs_info to btrfs_del_root instead of tree_root	2017-08-21 17:49:54 +02:00
free-space-tree.h	btrfs: expose internal free space tree routine only if sanity tests are enabled	2017-08-18 16:36:29 +02:00
hash.c	crypto: Work around deallocated stack frame reference gcc bug on sparc.	2017-06-08 17:36:03 +08:00
hash.h	btrfs: advertise which crc32c implementation is being used at module load	2016-06-06 14:08:28 +02:00
inode-item.c	btrfs: take an fs_info directly when the root is not used otherwise	2016-12-06 16:06:59 +01:00
inode-map.c	btrfs: qgroup: Introduce extent changeset for qgroup reserve functions	2017-06-29 20:17:02 +02:00
inode-map.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
inode.c	btrfs: Fix quota reservation leak on preallocated files	2018-02-25 11:08:00 +01:00
ioctl.c	btrfs: Fix possible off-by-one in btrfs_search_path_in_tree	2018-02-25 11:08:00 +01:00
Kconfig	btrfs: Add zstd support	2017-08-15 09:02:09 -07:00
locking.c
locking.h
lzo.c	btrfs: switch to kvmalloc and GFP_KERNEL in lzo/zlib alloc_workspace	2017-06-19 18:26:02 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
math.h
ordered-data.c	btrfs: fix integer overflow in calc_reclaim_items_nr	2017-06-29 20:17:02 +02:00
ordered-data.h	btrfs: fix integer overflow in calc_reclaim_items_nr	2017-06-29 20:17:02 +02:00
orphan.c
print-tree.c	Btrfs: add one more sanity check for shared ref type	2017-08-21 17:47:43 +02:00
print-tree.h	btrfs: get fs_info from eb in btrfs_print_tree, remove argument	2017-08-16 16:12:03 +02:00
props.c	Merge branch 'zstd-minimal' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2017-09-14 17:30:49 -07:00
props.h
qgroup.c	btrfs: Report error on removing qgroup if del_qgroup_item fails	2017-09-26 14:54:01 +02:00
qgroup.h	btrfs: qgroup: Fix qgroup reserved space underflow by only freeing reserved ranges	2017-06-29 20:17:02 +02:00
raid56.c	btrfs: Fix NULL pointer exception in find_bio_stripe	2018-03-21 12:06:44 +01:00
raid56.h	btrfs: take an fs_info directly when the root is not used otherwise	2016-12-06 16:06:59 +01:00
rcu-string.h
reada.c	btrfs: remove unused member err from reada_extent	2017-06-19 18:25:59 +02:00
relocation.c	btrfs: fix NULL pointer dereference from free_reloc_roots()	2017-09-26 14:51:49 +02:00
root-tree.c	Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-09-14 18:54:01 -07:00
scrub.c	Merge branch 'for-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux	2017-09-09 13:27:51 -07:00
send.c	Btrfs: incremental send, fix wrong unlink path after renaming file	2018-02-03 17:39:10 +01:00
send.h
struct-funcs.c	btrfs: struct-funcs, constify readers	2017-08-16 14:19:53 +02:00
super.c	btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit	2017-12-20 10:10:30 +01:00
sysfs.c	Revert "btrfs: use proper endianness accessors for super_copy"	2018-03-19 08:42:47 +01:00
sysfs.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
transaction.c	Revert "btrfs: use proper endianness accessors for super_copy"	2018-03-19 08:42:47 +01:00
transaction.h	btrfs: remove unused qgroup members from btrfs_trans_handle	2017-04-18 14:07:25 +02:00
tree-defrag.c
tree-log.c	Btrfs: fix unexpected -EEXIST when creating new inode	2018-02-22 15:42:30 +01:00
tree-log.h	btrfs: Make btrfs_del_inode_ref take btrfs_inode	2017-02-14 15:50:54 +01:00
ulist.c	btrfs: ulist: rename ulist_fini to ulist_release	2017-02-17 12:03:50 +01:00
ulist.h	btrfs: ulist: rename ulist_fini to ulist_release	2017-02-17 12:03:50 +01:00
uuid-tree.c	btrfs: return the actual error value from from btrfs_uuid_tree_iterate	2016-12-19 18:08:15 +01:00
volumes.c	btrfs: Fix flush bio leak	2018-03-03 10:24:32 +01:00
volumes.h	Merge branch 'for-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux	2017-09-09 13:27:51 -07:00
xattr.c	btrfs: Check name_len with boundary in verify dir_item	2017-06-21 19:16:04 +02:00
xattr.h	btrfs: Switch to generic xattr handlers	2016-05-17 19:17:09 -04:00
zlib.c	btrfs: switch to kvmalloc and GFP_KERNEL in lzo/zlib alloc_workspace	2017-06-19 18:26:02 +02:00
zstd.c	btrfs: Add zstd support	2017-08-15 09:02:09 -07:00