From 2187540b6f4d92b4bf7622244dc2cbfa61ff1855 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Wed, 9 Apr 2025 16:17:16 +0100 Subject: [PATCH] btrfs: exit after state split error at btrfs_clear_extent_bit_changeset() If split_state() returned an error we call extent_io_tree_panic() which will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then we fallthrough and hit a use after free when calling clear_state_bit() since the extent state record which the local variable 'prealloc' points to was freed by split_state(). So jump to the label 'out' after calling extent_io_tree_panic() and set the 'prealloc' pointer to NULL since split_state() has already freed it when it hit an error. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba --- fs/btrfs/extent-io-tree.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/extent-io-tree.c b/fs/btrfs/extent-io-tree.c index 15400a0f899c..b868313e777e 100644 --- a/fs/btrfs/extent-io-tree.c +++ b/fs/btrfs/extent-io-tree.c @@ -712,8 +712,11 @@ hit_next: if (!prealloc) goto search_again; err = split_state(tree, state, prealloc, end + 1); - if (err) + if (err) { extent_io_tree_panic(tree, state, "split", err); + prealloc = NULL; + goto out; + } if (wake) wake_up(&state->wq); -- 2.25.1