btrfs: add a sanity check for csum root before filling the data csum

Syzbot reported a null-ptr-deref in btrfs_lookup_csums_bitmap(). The btrfs mount options enable IGNOREDATACSUMS, which prevents the csum root from being loaded. Before filling in the csum data, check the flag BTRFS_FS_STATE_NO_DATA_CSUMS to confirm that the csum root has been loaded. Reported-and-tested-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=5d2b33d7835870519b5f CC: [email protected] # 6.6+ Reviewed-by: Qu Wenruo <[email protected]> Signed-off-by: Edward Adam Davis <[email protected]> Reviewed-by: David Sterba <[email protected]> Signed-off-by: David Sterba <[email protected]>
btrfs · Oct 29, 2024 · 62a0751 · 62a0751
1 parent fb8daf6
commit 62a0751
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
@@ -1601,8 +1601,9 @@ static int scrub_find_fill_first_stripe(struct btrfs_block_group *bg,
 		cur_logical = extent_start + extent_len;
 	}
 
-	/* Now fill the data csum. */
-	if (bg->flags & BTRFS_BLOCK_GROUP_DATA) {
+	/* Now fill the data checksums (if the checksum tree is set up). */
+	if (!test_bit(BTRFS_FS_STATE_NO_DATA_CSUMS, &fs_info->fs_state) &&
+	    bg->flags & BTRFS_BLOCK_GROUP_DATA) {
 		int sector_nr;
 		unsigned long csum_bitmap = 0;