Re: [PATCH] btrfs: fix NULL pointer dereference in do_abort_log_replay

[Filipe Manana]

On Fri, Dec 19, 2025 at 5:18 PM Suchit Karunakaran
<suchitkarunakaran@xxxxxxxxx> wrote:
>
> Coverity reported a NULL pointer dereference issue (CID 1666756) in
> do_abort_log_replay(). When btrfs_alloc_path() fails in
> replay_one_buffer(), wc->subvol_path is NULL, but btrfs_abort_log_replay()
> calls do_abort_log_replay() which unconditionally dereferences
> wc->subvol_path when attempting to print debug information. Fix this by
> adding a NULL check before dereferencing wc->subvol_path in
> do_abort_log_replay().
>
> Signed-off-by: Suchit Karunakaran <suchitkarunakaran@xxxxxxxxx>

Reviewed-by: Filipe Manana <fdmanana@xxxxxxxx>

Thanks, I'll add it to the for-next github branch with a proper Fixes tag.

> ---
>  fs/btrfs/tree-log.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
> index 5831754bb01c..2d9d38b82daa 100644
> --- a/fs/btrfs/tree-log.c
> +++ b/fs/btrfs/tree-log.c
> @@ -190,7 +190,7 @@ static void do_abort_log_replay(struct walk_control *wc, const char *function,
>
>         btrfs_abort_transaction(wc->trans, error);
>
> -       if (wc->subvol_path->nodes[0]) {
> +       if (wc->subvol_path && wc->subvol_path->nodes[0]) {
>                 btrfs_crit(fs_info,
>                            "subvolume (root %llu) leaf currently being processed:",
>                            btrfs_root_id(wc->root));
> --
> 2.52.0
>
>