https://launchpad.net/bugs/601877
btrfs_search_slot() returns * -1 when some error is encountered * +1 when the item to be searched is not found * 0 when the item is found successfully. Now, read_node_slot() fails due to an I/O error or due to a malloc failure. When read_node_slot() cannot read the item to be searched, then btrfs_search_slot() should return a -1 and not +1 as it was originally returning. The caller of btrfs_search_slot() expects that on +1, the path[] is appropriately populated. But due to the error in read_node_slot(), path[] is not getting populated. Accessing the unpopulated path[] leads to a segfault. Signed-off-by: Surbhi Palande <[email protected]> --- ctree.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/ctree.c b/ctree.c index f70e10c..8ec7bf8 100644 --- a/ctree.c +++ b/ctree.c @@ -1264,6 +1264,9 @@ again: key->objectid); b = read_node_slot(root, b, slot); + if (!b) { + return -1; + } } else { p->slots[level] = slot; if (ins_len > 0 && -- 1.7.0.4 -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
