btrfs: fix invalid inode pointer dereferences during log replay
authorFilipe Manana <fdmanana@suse.com>
Tue, 3 Jun 2025 18:29:01 +0000 (19:29 +0100)
committerDavid Sterba <dsterba@suse.com>
Thu, 19 Jun 2025 13:20:42 +0000 (15:20 +0200)
commit2dcf838cf5c2f0f4501edaa1680fcad03618d760
treed68a96dc262f3f86e5ec3861b1936c79b7920ce1
parente5b5596011773a38e035e9633ed928ef13c720b1
btrfs: fix invalid inode pointer dereferences during log replay

In a few places where we call read_one_inode(), if we get a NULL pointer
we end up jumping into an error path, or fallthrough in case of
__add_inode_ref(), where we then do something like this:

   iput(&inode->vfs_inode);

which results in an invalid inode pointer that triggers an invalid memory
access, resulting in a crash.

Fix this by making sure we don't do such dereferences.

Fixes: b4c50cbb01a1 ("btrfs: return a btrfs_inode from read_one_inode()")
CC: stable@vger.kernel.org # 6.15+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
fs/btrfs/tree-log.c