Merge tag 'for-5.9-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave...

Pull btrfs fixes from David Sterba:
 "syzkaller started to hit us with reports, here's a fix for one type
  (stack overflow when printing checksums on read error).

  The other patch is a fix for sysfs object, we have a test for that and
  it leads to a crash."

* tag 'for-5.9-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: fix put of uninitialized kobject after seed device delete
  btrfs: fix overflow when copying corrupt csums for a message

diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index abf86b2..9f72b09 100644 (file)
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -636,16 +636,15 @@ static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio,
        csum_tree_block(eb, result);
 
        if (memcmp_extent_buffer(eb, result, 0, csum_size)) {
-               u32 val;
-               u32 found = 0;
-
-               memcpy(&found, result, csum_size);
+               u8 val[BTRFS_CSUM_SIZE] = { 0 };
 
                read_extent_buffer(eb, &val, 0, csum_size);
                btrfs_warn_rl(fs_info,
-               "%s checksum verify failed on %llu wanted %x found %x level %d",
+       "%s checksum verify failed on %llu wanted " CSUM_FMT " found " CSUM_FMT " level %d",
                              fs_info->sb->s_id, eb->start,
-                             val, found, btrfs_header_level(eb));
+                             CSUM_FMT_VALUE(csum_size, val),
+                             CSUM_FMT_VALUE(csum_size, result),
+                             btrfs_header_level(eb));
                ret = -EUCLEAN;
                goto err;
        }

diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index c8df2ed..5be3006 100644 (file)
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -1170,10 +1170,12 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices,
                                          disk_kobj->name);
                }
 
-               kobject_del(&one_device->devid_kobj);
-               kobject_put(&one_device->devid_kobj);
+               if (one_device->devid_kobj.state_initialized) {
+                       kobject_del(&one_device->devid_kobj);
+                       kobject_put(&one_device->devid_kobj);
 
-               wait_for_completion(&one_device->kobj_unregister);
+                       wait_for_completion(&one_device->kobj_unregister);
+               }
 
                return 0;
        }
@@ -1186,10 +1188,12 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices,
                        sysfs_remove_link(fs_devices->devices_kobj,
                                          disk_kobj->name);
                }
-               kobject_del(&one_device->devid_kobj);
-               kobject_put(&one_device->devid_kobj);
+               if (one_device->devid_kobj.state_initialized) {
+                       kobject_del(&one_device->devid_kobj);
+                       kobject_put(&one_device->devid_kobj);
 
-               wait_for_completion(&one_device->kobj_unregister);
+                       wait_for_completion(&one_device->kobj_unregister);
+               }
        }
 
        return 0;