diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2019-07-30 20:28:20 +0200 |
|---|---|---|
| committer | Darrick J. Wong <darrick.wong@oracle.com> | 2019-07-30 20:28:20 +0200 |
| commit | afa1d96d1430c2138c545fb76e6dcb21222098d4 (patch) | |
| tree | dd6f7213cff728deae942e9fc7a46d9bfd0d35b5 /fs | |
| parent | xfs: fix stack contents leakage in the v1 inumber ioctls (diff) | |
| download | linux-afa1d96d1430c2138c545fb76e6dcb21222098d4.tar.xz linux-afa1d96d1430c2138c545fb76e6dcb21222098d4.zip | |
xfs: Fix possible null-pointer dereferences in xchk_da_btree_block_check_sibling()
In xchk_da_btree_block_check_sibling(), there is an if statement on
line 274 to check whether ds->state->altpath.blk[level].bp is NULL:
if (ds->state->altpath.blk[level].bp)
When ds->state->altpath.blk[level].bp is NULL, it is used on line 281:
xfs_trans_brelse(..., ds->state->altpath.blk[level].bp);
struct xfs_buf_log_item *bip = bp->b_log_item;
ASSERT(bp->b_transp == tp);
Thus, possible null-pointer dereferences may occur.
To fix these bugs, ds->state->altpath.blk[level].bp is checked before
being used.
These bugs are found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/xfs/scrub/dabtree.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/fs/xfs/scrub/dabtree.c b/fs/xfs/scrub/dabtree.c index 94c4f1de1922..77ff9f97bcda 100644 --- a/fs/xfs/scrub/dabtree.c +++ b/fs/xfs/scrub/dabtree.c @@ -278,7 +278,11 @@ xchk_da_btree_block_check_sibling( /* Compare upper level pointer to sibling pointer. */ if (ds->state->altpath.blk[level].blkno != sibling) xchk_da_set_corrupt(ds, level); - xfs_trans_brelse(ds->dargs.trans, ds->state->altpath.blk[level].bp); + if (ds->state->altpath.blk[level].bp) { + xfs_trans_brelse(ds->dargs.trans, + ds->state->altpath.blk[level].bp); + ds->state->altpath.blk[level].bp = NULL; + } out: return error; } |