btrfs: exit after state split error at btrfs_clear_extent_bit_changeset()

If split_state() returned an error we call extent_io_tree_panic() which
will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an
uncommon and exotic scenario, then we fallthrough and hit a use after free
when calling clear_state_bit() since the extent state record which the
local variable 'prealloc' points to was freed by split_state().

So jump to the label 'out' after calling extent_io_tree_panic() and set
the 'prealloc' pointer to NULL since split_state() has already freed it
when it hit an error.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/extent-io-tree.c b/fs/btrfs/extent-io-tree.c
index 15400a0f899c9651151f560be7c10975d864059b..b868313e777eb95014997cb7cd5d49661100cc05 100644 (file)
--- a/fs/btrfs/extent-io-tree.c
+++ b/fs/btrfs/extent-io-tree.c
@@ -712,8 +712,11 @@ hit_next:
                if (!prealloc)
                        goto search_again;
                err = split_state(tree, state, prealloc, end + 1);
-               if (err)
+               if (err) {
                        extent_io_tree_panic(tree, state, "split", err);
+                       prealloc = NULL;
+                       goto out;
+               }
 
                if (wake)
                        wake_up(&state->wq);