• Anand Jain's avatar
    btrfs: fix put of uninitialized kobject after seed device delete · b5ddcffa
    Anand Jain authored
    The following test case leads to NULL kobject free error:
    
      mount seed /mnt
      add sprout to /mnt
      umount /mnt
      mount sprout to /mnt
      delete seed
    
      kobject: '(null)' (00000000dd2b87e4): is not initialized, yet kobject_put() is being called.
      WARNING: CPU: 1 PID: 15784 at lib/kobject.c:736 kobject_put+0x80/0x350
      RIP: 0010:kobject_put+0x80/0x350
      ::
      Call Trace:
      btrfs_sysfs_remove_devices_dir+0x6e/0x160 [btrfs]
      btrfs_rm_device.cold+0xa8/0x298 [btrfs]
      btrfs_ioctl+0x206c/0x22a0 [btrfs]
      ksys_ioctl+0xe2/0x140
      __x64_sys_ioctl+0x1e/0x29
      do_syscall_64+0x96/0x150
      entry_SYSCALL_64_after_hwframe+0x44/0xa9
      RIP: 0033:0x7f4047c6288b
      ::
    
    This is because, at the end of the seed device-delete, we try to remove
    the seed's devid sysfs entry. But for the seed devices under the sprout
    fs, we don't initialize the devid kobject yet. So add a kobject state
    check, which takes care of the bug.
    
    Fixes: 668e48af ("btrfs: sysfs, add devid/dev_state kobject and device attributes")
    CC: stable@vger.kernel.org # 5.6+
    Signed-off-by: default avatarAnand Jain <anand.jain@oracle.com>
    Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
    Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
    b5ddcffa
sysfs.c 45 KB