xfs: don't crash on unexpected holes in dir/attr btrees
authorDarrick J. Wong <darrick.wong@oracle.com>
Sun, 17 Sep 2017 21:06:35 +0000 (14:06 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Sep 2017 06:19:58 +0000 (08:19 +0200)
commite76496fa85543c48858c537c1a6465068e18db8b
tree9d633a36b408c02df2a88961e7eb57f6c6adf882
parentb46382f02aff8d9ac141714bc6ae4f972836816f
xfs: don't crash on unexpected holes in dir/attr btrees

commit cd87d867920155911d0d2e6485b769d853547750 upstream.

In quite a few places we call xfs_da_read_buf with a mappedbno that we
don't control, then assume that the function passes back either an error
code or a buffer pointer.  Unfortunately, if mappedbno == -2 and bno
maps to a hole, we get a return code of zero and a NULL buffer, which
means that we crash if we actually try to use that buffer pointer.  This
happens immediately when we set the buffer type for transaction context.

Therefore, check that we have no error code and a non-NULL bp before
trying to use bp.  This patch is a follow-up to an incomplete fix in
96a3aefb8ffde231 ("xfs: don't crash if reading a directory results in an
unexpected hole").

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/xfs/libxfs/xfs_attr_leaf.c
fs/xfs/libxfs/xfs_da_btree.c
fs/xfs/libxfs/xfs_dir2_block.c
fs/xfs/libxfs/xfs_dir2_leaf.c