Skip to content

Commit 04679f3

Browse files
bongiojpbrauner
authored andcommitted
fs: Remove redundant errseq_set call in mark_buffer_write_io_error.
mark_buffer_write_io_error sets sb->s_wb_err to -EIO twice. Once in mapping_set_error and once in errseq_set. Only mapping_set_error checks if bh->b_assoc_map->host is NULL. Discovered during null pointer dereference during writeback to a failing device: [<ffffffff9a416dc8>] ? mark_buffer_write_io_error+0x98/0xc0 [<ffffffff9a416dbe>] ? mark_buffer_write_io_error+0x8e/0xc0 [<ffffffff9ad4bda0>] end_buffer_async_write+0x90/0xd0 [<ffffffff9ad4e3eb>] end_bio_bh_io_sync+0x2b/0x40 [<ffffffff9adbafe6>] blk_update_request+0x1b6/0x480 [<ffffffff9adbb3d8>] blk_mq_end_request+0x18/0x30 [<ffffffff9adbc6aa>] blk_mq_dispatch_rq_list+0x4da/0x8e0 [<ffffffff9adc0a68>] __blk_mq_sched_dispatch_requests+0x218/0x6a0 [<ffffffff9adc07fa>] blk_mq_sched_dispatch_requests+0x3a/0x80 [<ffffffff9adbbb98>] blk_mq_run_hw_queue+0x108/0x330 [<ffffffff9adbcf58>] blk_mq_flush_plug_list+0x178/0x5f0 [<ffffffff9adb6741>] __blk_flush_plug+0x41/0x120 [<ffffffff9adb6852>] blk_finish_plug+0x22/0x40 [<ffffffff9ad47cb0>] wb_writeback+0x150/0x280 [<ffffffff9ac5343f>] ? set_worker_desc+0x9f/0xc0 [<ffffffff9ad4676e>] wb_workfn+0x24e/0x4a0 Fixes: 485e960 ("fs/buffer.c: record blockdev write errors in super_block that it backs") Signed-off-by: Jeremy Bongio <[email protected]> Link: https://lore.kernel.org/[email protected] Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Christian Brauner <[email protected]>
1 parent 6ba0982 commit 04679f3

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

fs/buffer.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1220,10 +1220,8 @@ void mark_buffer_write_io_error(struct buffer_head *bh)
12201220
/* FIXME: do we need to set this in both places? */
12211221
if (bh->b_folio && bh->b_folio->mapping)
12221222
mapping_set_error(bh->b_folio->mapping, -EIO);
1223-
if (bh->b_assoc_map) {
1223+
if (bh->b_assoc_map)
12241224
mapping_set_error(bh->b_assoc_map, -EIO);
1225-
errseq_set(&bh->b_assoc_map->host->i_sb->s_wb_err, -EIO);
1226-
}
12271225
}
12281226
EXPORT_SYMBOL(mark_buffer_write_io_error);
12291227

0 commit comments

Comments
 (0)