diff options
| author | Prince Kumar Maurya <princekumarmaurya06@gmail.com> | 2023-05-31 03:31:41 +0200 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2023-06-01 09:51:06 +0200 |
| commit | ea2b62f305893992156a798f665847e0663c9f41 (patch) | |
| tree | 4978b5a77ed5f8f0e9923e8d8340917e578e72a9 /fs/sysv | |
| parent | fs: use UB-safe check for signed addition overflow in remap_verify_area (diff) | |
| download | linux-ea2b62f305893992156a798f665847e0663c9f41.tar.xz linux-ea2b62f305893992156a798f665847e0663c9f41.zip | |
fs/sysv: Null check to prevent null-ptr-deref bug
sb_getblk(inode->i_sb, parent) return a null ptr and taking lock on
that leads to the null-ptr-deref bug.
Reported-by: syzbot+aad58150cbc64ba41bdc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=aad58150cbc64ba41bdc
Signed-off-by: Prince Kumar Maurya <princekumarmaurya06@gmail.com>
Message-Id: <20230531013141.19487-1-princekumarmaurya06@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'fs/sysv')
| -rw-r--r-- | fs/sysv/itree.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c index b22764fe669c..58d7f43a1371 100644 --- a/fs/sysv/itree.c +++ b/fs/sysv/itree.c @@ -145,6 +145,10 @@ static int alloc_branch(struct inode *inode, */ parent = block_to_cpu(SYSV_SB(inode->i_sb), branch[n-1].key); bh = sb_getblk(inode->i_sb, parent); + if (!bh) { + sysv_free_block(inode->i_sb, branch[n].key); + break; + } lock_buffer(bh); memset(bh->b_data, 0, blocksize); branch[n].bh = bh; |