btrfs: fix NULL dereference on root when tracing inode eviction

[PATCH] btrfs: fix NULL dereference on root when tracing inode eviction

Posted by Miquel Sabaté Solà 3 months, 2 weeks ago

When evicting an inode the first thing we do is to setup tracing for it,
which implies fetching the root's id. But in btrfs_evict_inode() the
root might be NULL, as implied in the next check that we do in
btrfs_evict_inode().

Hence, we either should set the ->root_objectid to 0 in case the root is
NULL, or we move tracing setup after checking that the root is not
NULL. Setting the rootid to 0 at least gives us the possibility to trace
this call even in the case when the root is NULL, so that's the solution
taken here.

Fixes: 1abe9b8a138c ("Btrfs: add initial tracepoint support for btrfs")
Reported-by: syzbot+d991fea1b4b23b1f6bf8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d991fea1b4b23b1f6bf8
Signed-off-by: Miquel Sabaté Solà <mssola@mssola.com>
---
 include/trace/events/btrfs.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
index 7e418f065b94..f17ee9ba2cf6 100644
--- a/include/trace/events/btrfs.h
+++ b/include/trace/events/btrfs.h
@@ -224,7 +224,8 @@ DECLARE_EVENT_CLASS(btrfs__inode,
 		__entry->generation = BTRFS_I(inode)->generation;
 		__entry->last_trans = BTRFS_I(inode)->last_trans;
 		__entry->logged_trans = BTRFS_I(inode)->logged_trans;
-		__entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root);
+		__entry->root_objectid =
+			     BTRFS_I(inode)->root ? btrfs_root_id(BTRFS_I(inode)->root) : 0;
 	),

 	TP_printk_btrfs("root=%llu(%s) gen=%llu ino=%llu blocks=%llu "
--
2.51.1

Re: [PATCH] btrfs: fix NULL dereference on root when tracing inode eviction

Posted by David Sterba 2 months ago

On Tue, Oct 21, 2025 at 11:11:25AM +0200, Miquel Sabaté Solà wrote:
> When evicting an inode the first thing we do is to setup tracing for it,
> which implies fetching the root's id. But in btrfs_evict_inode() the
> root might be NULL, as implied in the next check that we do in
> btrfs_evict_inode().
> 
> Hence, we either should set the ->root_objectid to 0 in case the root is
> NULL, or we move tracing setup after checking that the root is not
> NULL. Setting the rootid to 0 at least gives us the possibility to trace
> this call even in the case when the root is NULL, so that's the solution
> taken here.
> 
> Fixes: 1abe9b8a138c ("Btrfs: add initial tracepoint support for btrfs")
> Reported-by: syzbot+d991fea1b4b23b1f6bf8@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d991fea1b4b23b1f6bf8
> Signed-off-by: Miquel Sabaté Solà <mssola@mssola.com>

Added to for-next, thanks.