btrfs: exit after state insertion failure at btrfs_convert_extent_bit()

fdmanana · Sasha Levin · commit 4f6d43fd0b8d · 2025-06-17T21:41:33.000-04:00
[ Upstream commit 3bf179e ] If insert_state() state failed it returns an error pointer and we call extent_io_tree_panic() which will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then we fallthrough and call cache_state() which will dereference the error pointer, resulting in an invalid memory access. So jump to the 'out' label after calling extent_io_tree_panic(), it also makes the code more clear besides dealing with the exotic scenario where CONFIG_BUG is disabled. Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
diff --git a/fs/btrfs/extent-io-tree.c b/fs/btrfs/extent-io-tree.c
@@ -1456,6 +1456,7 @@ int convert_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
 		if (IS_ERR(inserted_state)) {
 			ret = PTR_ERR(inserted_state);
 			extent_io_tree_panic(tree, prealloc, "insert", ret);
+			goto out;
 		}
 		cache_state(inserted_state, cached_state);
 		if (inserted_state == prealloc)

Original file line number	Diff line number	Diff line change
`@@ -1456,6 +1456,7 @@ int convert_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,`
`1456`	`1456`	`if (IS_ERR(inserted_state)) {`
`1457`	`1457`	`ret = PTR_ERR(inserted_state);`
`1458`	`1458`	`extent_io_tree_panic(tree, prealloc, "insert", ret);`
	`1459`	`+ goto out;`
`1459`	`1460`	`}`
`1460`	`1461`	`cache_state(inserted_state, cached_state);`
`1461`	`1462`	`if (inserted_state == prealloc)`