Commit bffac4b5 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'for-5.9-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:
 "syzkaller started to hit us with reports, here's a fix for one type
  (stack overflow when printing checksums on read error).

  The other patch is a fix for sysfs object, we have a test for that and
  it leads to a crash."

* tag 'for-5.9-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: fix put of uninitialized kobject after seed device delete
  btrfs: fix overflow when copying corrupt csums for a message
parents 79a1971c b5ddcffa
...@@ -636,16 +636,15 @@ static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio, ...@@ -636,16 +636,15 @@ static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio,
csum_tree_block(eb, result); csum_tree_block(eb, result);
if (memcmp_extent_buffer(eb, result, 0, csum_size)) { if (memcmp_extent_buffer(eb, result, 0, csum_size)) {
u32 val; u8 val[BTRFS_CSUM_SIZE] = { 0 };
u32 found = 0;
memcpy(&found, result, csum_size);
read_extent_buffer(eb, &val, 0, csum_size); read_extent_buffer(eb, &val, 0, csum_size);
btrfs_warn_rl(fs_info, btrfs_warn_rl(fs_info,
"%s checksum verify failed on %llu wanted %x found %x level %d", "%s checksum verify failed on %llu wanted " CSUM_FMT " found " CSUM_FMT " level %d",
fs_info->sb->s_id, eb->start, fs_info->sb->s_id, eb->start,
val, found, btrfs_header_level(eb)); CSUM_FMT_VALUE(csum_size, val),
CSUM_FMT_VALUE(csum_size, result),
btrfs_header_level(eb));
ret = -EUCLEAN; ret = -EUCLEAN;
goto err; goto err;
} }
......
...@@ -1170,10 +1170,12 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices, ...@@ -1170,10 +1170,12 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices,
disk_kobj->name); disk_kobj->name);
} }
kobject_del(&one_device->devid_kobj); if (one_device->devid_kobj.state_initialized) {
kobject_put(&one_device->devid_kobj); kobject_del(&one_device->devid_kobj);
kobject_put(&one_device->devid_kobj);
wait_for_completion(&one_device->kobj_unregister); wait_for_completion(&one_device->kobj_unregister);
}
return 0; return 0;
} }
...@@ -1186,10 +1188,12 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices, ...@@ -1186,10 +1188,12 @@ int btrfs_sysfs_remove_devices_dir(struct btrfs_fs_devices *fs_devices,
sysfs_remove_link(fs_devices->devices_kobj, sysfs_remove_link(fs_devices->devices_kobj,
disk_kobj->name); disk_kobj->name);
} }
kobject_del(&one_device->devid_kobj); if (one_device->devid_kobj.state_initialized) {
kobject_put(&one_device->devid_kobj); kobject_del(&one_device->devid_kobj);
kobject_put(&one_device->devid_kobj);
wait_for_completion(&one_device->kobj_unregister); wait_for_completion(&one_device->kobj_unregister);
}
} }
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment