Filipe Manana 2dcf838cf5 btrfs: fix invalid inode pointer dereferences during log replay ...

In a few places where we call read_one_inode(), if we get a NULL pointer
we end up jumping into an error path, or fallthrough in case of
__add_inode_ref(), where we then do something like this:

   iput(&inode->vfs_inode);

which results in an invalid inode pointer that triggers an invalid memory
access, resulting in a crash.

Fix this by making sure we don't do such dereferences.

Fixes: b4c50cbb01 ("btrfs: return a btrfs_inode from read_one_inode()")
CC: stable@vger.kernel.org # 6.15+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

2025-06-19 15:20:42 +02:00

..

9p

Merge tag '9p-for-6.15-rc1' of https://github.com/martinetd/linux

2025-04-03 15:35:46 -07:00

adfs

Merge patch series "adfs, affs, befs, hfs, hfsplus: convert to new mount api"

2024-10-08 14:41:53 +02:00

affs

Merge tag 'vfs-6.15-rc1.async.dir' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 10:47:14 -07:00

afs

afs: Fix afs_dynroot_readdir() to not use the RCU read lock

2025-04-11 15:24:29 +02:00

autofs

Merge tag 'vfs-6.15-rc1.async.dir' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 10:47:14 -07:00

bcachefs

bcachefs: Don't aggressively discard the journal

2025-05-07 17:10:10 -04:00

befs

befs: convert befs to use the new mount api

2024-09-18 11:44:43 +02:00

bfs

…

btrfs

btrfs: fix invalid inode pointer dereferences during log replay

2025-06-19 15:20:42 +02:00

cachefiles

gcc-15: add '__nonstring' markers to byte arrays

2025-04-20 11:57:54 -07:00

ceph

Merge tag 'ceph-for-6.15-rc4' of https://github.com/ceph/ceph-client

2025-04-25 15:51:28 -07:00

coda

Change inode_operations.mkdir to return struct dentry *

2025-02-27 20:00:17 +01:00

configfs

Change inode_operations.mkdir to return struct dentry *

2025-02-27 20:00:17 +01:00

cramfs

…

crypto

Merge tag 'for-6.15/block-20250322' of git://git.kernel.dk/linux

2025-03-26 18:08:55 -07:00

debugfs

debugfs: Fix the missing initializations in __debugfs_file_get()

2025-01-30 08:22:31 +01:00

devpts

devpts: Fix type for uid and gid params

2025-04-07 15:22:12 +02:00

dlm

dlm: make tcp still work in multi-link env

2025-03-18 10:49:22 -05:00

ecryptfs

Merge tag 'vfs-6.15-rc1.async.dir' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 10:47:14 -07:00

efivarfs

Merge tag 'efi-next-for-v6.15' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi

2025-03-29 11:36:19 -07:00

efs

efs: fix the efs new mount api implementation

2024-10-15 15:58:36 +02:00

erofs

erofs: ensure the extra temporary copy is valid for shortened bvecs

2025-05-07 09:50:51 +08:00

exfat

exfat: call bh_read in get_block only when necessary

2025-03-29 22:03:11 +09:00

exportfs

exportfs: add module description

2025-03-25 15:57:58 +01:00

ext2

Merge tag 'fs_for_v6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2025-03-31 17:53:44 -07:00

ext4

mm/migrate: fix sleep in atomic for large folios and buffer heads

2025-04-22 18:16:08 +02:00

f2fs

Merge tag 'f2fs-for-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

2025-03-27 12:55:54 -07:00

fat

Change inode_operations.mkdir to return struct dentry *

2025-02-27 20:00:17 +01:00

freevxfs

freevxfs: Replace one-element array with flexible array member

2024-11-06 10:42:06 +01:00

fuse

virtiofs: add filesystem context source name check

2025-04-07 15:22:25 +02:00

gfs2

lib/crc: remove CONFIG_LIBCRC32C

2025-04-04 11:31:42 -07:00

hfs

Revert "hfs{plus}: add deprecation warning"

2025-04-19 22:48:59 +02:00

hfsplus

Revert "hfs{plus}: add deprecation warning"

2025-04-19 22:48:59 +02:00

hostfs

Merge tag 'uml-for-linux-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux

2025-04-02 12:25:03 -07:00

hpfs

Change inode_operations.mkdir to return struct dentry *

2025-02-27 20:00:17 +01:00

hugetlbfs

Merge tag 'mm-stable-2025-03-30-16-52' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-04-01 09:29:18 -07:00

iomap

iomap: skip unnecessary ifs_block_is_uptodate check

2025-04-11 16:02:27 +02:00

isofs

isofs: Prevent the use of too small fid

2025-04-04 12:28:32 +02:00

jbd2

fs/jbd2: use sleeping version of __find_get_block()

2025-04-22 18:16:08 +02:00

jffs2

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05 10:30:12 +02:00

jfs

Merge tag 'jfs-6.14' of github.com:kleikamp/linux-shaggy

2025-03-27 13:17:39 -07:00

kernfs

Merge tag 'driver-core-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

2025-04-01 11:02:03 -07:00

lockd

sysctl: Fixes nsm_local_state bounds

2025-03-10 09:11:13 -04:00

minix

Change inode_operations.mkdir to return struct dentry *

2025-02-27 20:00:17 +01:00

netfs

netfs: Mark __nonstring lookup tables

2025-04-17 10:13:46 +02:00

nfs

Merge tag 'nfsd-6.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2025-04-19 10:38:03 -07:00

nfs_common

fs: nfs: acl: Avoid -Wflex-array-member-not-at-end warning

2025-03-10 09:11:04 -04:00

nfsd

Merge tag 'nfsd-6.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2025-04-19 10:38:03 -07:00

nilfs2

nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()

2025-05-07 23:39:42 -07:00

nls

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

notify

fanotify: fix flush of mntns marks

2025-04-24 10:58:59 +02:00

ntfs3

Merge tag 'ntfs3_for_6.15' of https://github.com/Paragon-Software-Group/linux-ntfs3

2025-04-02 16:30:02 -07:00

ocfs2

ocfs2: stop quota recovery before disabling quotas

2025-05-07 23:39:40 -07:00

omfs

Change inode_operations.mkdir to return struct dentry *

2025-02-27 20:00:17 +01:00

openpromfs

…

orangefs

Merge tag 'for-linus-6.15-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux

2025-03-27 13:14:39 -07:00

overlayfs

ovl: remove unused forward declaration

2025-04-07 11:22:49 +02:00

proc

Merge tag 'mm-nonmm-stable-2025-03-30-18-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-04-01 10:06:52 -07:00

pstore

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05 10:30:12 +02:00

qnx4

…

qnx6

fs/qnx6: Fix building with GCC 15

2024-12-03 10:40:36 +01:00

quota

treewide: const qualify ctl_tables where applicable

2025-01-28 13:48:37 +01:00

ramfs

Change inode_operations.mkdir to return struct dentry *

2025-02-27 20:00:17 +01:00

romfs

…

smb

Merge tag '6.15-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

2025-05-09 16:45:21 -07:00

squashfs

squashfs: fix invalid pointer dereference in squashfs_cache_delete

2025-03-16 17:40:24 -07:00

sysfs

kernfs: Use RCU to access kernfs_node::name.

2025-02-15 17:46:32 +01:00

tests

…

tracefs

Change inode_operations.mkdir to return struct dentry *

2025-02-27 20:00:17 +01:00

ubifs

Merge tag 'v6.15-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

2025-03-29 10:01:55 -07:00

udf

udf: Make sure i_lenExtents is uptodate on inode eviction

2025-05-07 12:04:07 +02:00

ufs

Change inode_operations.mkdir to return struct dentry *

2025-02-27 20:00:17 +01:00

unicode

unicode: kunit: change tests filename and path

2025-02-12 14:00:11 -08:00

vboxsf

Merge tag 'vfs-6.15-rc1.async.dir' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 10:47:14 -07:00

verity

Revert "fsverity: relax build time dependency on CRYPTO_SHA256"

2025-02-17 11:34:15 -08:00

xfs

XFS: fix zoned gc threshold math for 32-bit arches

2025-04-22 16:03:14 +02:00

zonefs

iomap: pass private data to iomap_page_mkwrite

2025-02-06 13:02:15 +01:00

aio.c

treewide: const qualify ctl_tables where applicable

2025-01-28 13:48:37 +01:00

anon_inodes.c

add a string-to-qstr constructor

2025-01-27 19:25:45 -05:00

attr.c

fs: handle delegated timestamps in setattr_copy_mgtime

2024-10-10 10:20:51 +02:00

backing-file.c

tree-wide: s/revert_creds_light()/revert_creds()/g

2024-12-02 11:25:09 +01:00

bad_inode.c

Change inode_operations.mkdir to return struct dentry *

2025-02-27 20:00:17 +01:00

binfmt_elf_fdpic.c

binfmt_elf_fdpic: fix variable set but not used warning

2025-03-07 20:07:33 -08:00

binfmt_elf.c

binfmt_elf: Move brk for static PIE even if ASLR disabled

2025-05-01 17:13:53 -07:00

binfmt_flat.c

binfmt_flat: Fix integer overflow bug on 32 bit systems

2025-01-10 08:49:05 -08:00

binfmt_misc.c

Merge tag 'execve-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2025-01-20 13:27:58 -08:00

binfmt_script.c

…

bpf_fs_kfuncs.c

bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs

2025-02-13 19:35:32 -08:00

buffer.c

fs: Remove redundant errseq_set call in mark_buffer_write_io_error.

2025-05-09 12:31:57 +02:00

char_dev.c

fs: Reorganize kerneldoc parameter names

2024-10-22 11:16:57 +02:00

compat_binfmt_elf.c

binfmt_elf: Wire up AT_HWCAP3 at AT_HWCAP4

2024-10-17 18:38:49 +01:00

coredump.c

Merge tag 'sysctl-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl

2025-03-26 21:02:05 -07:00

d_path.c

…

dax.c

fs/dax: fix folio splitting issue by resetting old folio order + _nr_pages

2025-04-17 20:10:06 -07:00

dcache.c

Merge tag 'sysctl-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl

2025-03-26 21:02:05 -07:00

direct-io.c

…

drop_caches.c

fs: drop_caches: move sysctl to fs/drop_caches.c

2025-02-07 16:53:04 +01:00

eventfd.c

make use of anon_inode_getfile_fmode()

2025-02-21 10:25:31 +01:00

eventpoll.c

fs/eventpoll: fix endless busy loop after timeout has expired

2025-05-02 14:21:26 +02:00

exec.c

rseq: Eliminate useless task_work on execve

2025-04-03 13:10:47 +02:00

fcntl.c

fs: get rid of __FMODE_NONOTIFY kludge

2024-12-09 11:34:29 +01:00

fhandle.c

exportfs: add permission method

2024-12-17 09:16:11 +01:00

file_table.c

Merge tag 'vfs-6.15-rc1.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 13:19:17 -07:00

file.c

fs: fall back to file_ref_put() for non-last reference

2025-04-22 18:16:09 +02:00

filesystems.c

…

fs_context.c

fs: fc_log replace magic number 7 with ARRAY_SIZE()

2024-12-22 11:29:52 +01:00

fs_parser.c

bcachefs: add support for true/false & yes/no in bool-type options

2024-12-21 01:36:17 -05:00

fs_pin.c

…

fs_struct.c

…

fs_types.c

…

fs-writeback.c

fs: fs-writeback: move sysctl to fs/fs-writeback.c

2025-02-07 16:53:04 +01:00

fsopen.c

fs: support O_PATH fds with FSCONFIG_SET_FD

2025-02-12 10:02:10 +01:00

init.c

VFS: Change vfs_mkdir() to return the dentry.

2025-03-05 11:52:50 +01:00

inode.c

fs: call inode_sb_list_add() outside of inode hash lock

2025-03-20 13:06:51 +01:00

internal.h

Merge tag 'vfs-6.15-rc1.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 13:19:17 -07:00

ioctl.c

ioctl: Fix return type of several functions from long to int

2025-02-21 10:25:32 +01:00

Kconfig

Merge tag 'nfsd-6.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2025-04-19 10:38:03 -07:00

Kconfig.binfmt

…

kernel_read_file.c

fdget(), trivial conversions

2024-11-03 01:28:06 -05:00

libfs.c

Merge tag 'vfs-6.15-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 10:16:37 -07:00

locks.c

treewide: const qualify ctl_tables where applicable

2025-01-28 13:48:37 +01:00

Makefile

sysv: Remove the filesystem

2025-02-21 10:32:47 +01:00

mbcache.c

…

mnt_idmapping.c

statmount: allow to retrieve idmappings

2025-02-12 12:12:27 +01:00

mount.h

Merge tag 'vfs-6.15-rc1.mount.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 11:41:41 -07:00

mpage.c

fs/buffer fs/mpage: remove large folio restriction

2025-02-24 11:44:44 +01:00

namei.c

fs: ensure that *path_locked*() helpers leave passed path pristine

2025-04-16 09:33:09 +02:00

namespace.c

fix IS_MNT_PROPAGATING uses

2025-05-09 18:06:27 -04:00

nsfs.c

Merge tag 'vfs-6.15-rc1.nsfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 11:38:12 -07:00

open.c

Merge tag 'vfs-6.15-rc1.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 13:19:17 -07:00

pidfs.c

Merge tag 'vfs-6.15-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 10:16:37 -07:00

pipe.c

Merge patch series "pipe: Trivial cleanups"

2025-03-10 08:55:13 +01:00

pnode.c

fix IS_MNT_PROPAGATING uses

2025-05-09 18:06:27 -04:00

pnode.h

fix IS_MNT_PROPAGATING uses

2025-05-09 18:06:27 -04:00

posix_acl.c

acl: Annotate struct posix_acl with __counted_by()

2024-10-22 11:16:59 +02:00

proc_namespace.c

…

read_write.c

fs: don't needlessly acquire f_lock

2025-02-21 10:25:32 +01:00

readdir.c

introduce "fd_pos" class, convert fdget_pos() users to it.

2024-11-03 01:28:06 -05:00

remap_range.c

convert vfs_dedupe_file_range().

2024-11-03 01:28:07 -05:00

select.c

select: Fix unbalanced user_access_end()

2025-01-13 16:24:16 +01:00

seq_file.c

fs: Reorganize kerneldoc parameter names

2024-10-22 11:16:57 +02:00

signalfd.c

make use of anon_inode_getfile_fmode()

2025-02-21 10:25:31 +01:00

splice.c

splice: remove duplicate noinline from pipe_clear_nowait

2025-04-25 12:11:56 +02:00

stack.c

…

stat.c

fs: move the bdex_statx call to vfs_getattr_nosec

2025-04-17 10:14:34 +02:00

statfs.c

fdget_raw() users: switch to CLASS(fd_raw)

2024-11-03 01:28:06 -05:00

super.c

Merge tag 'vfs-6.15-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-03-24 09:13:50 -07:00

sync.c

fdget(), trivial conversions

2024-11-03 01:28:06 -05:00

sysctls.c

treewide: const qualify ctl_tables where applicable

2025-01-28 13:48:37 +01:00

timerfd.c

Merge tag 'timers-cleanups-2025-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2025-03-25 10:54:15 -07:00

userfaultfd.c

mm/userfaultfd: fix uninitialized output field for -EAGAIN race

2025-05-07 23:39:39 -07:00

utimes.c

fdget(), more trivial conversions

2024-11-03 01:28:06 -05:00

xattr.c

fs/xattr.c: fix simple_xattr_list to always include security.* xattrs

2025-04-28 10:53:22 +02:00