lkml.org 
[lkml]   [2019]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] fs: reiserfs: Fix possible null-pointer dereferences in remove_from_transaction()
Date
In remove_from_transaction(), there is an if statement on line 3447 to
check whether bh is NULL:
if (bh)

When bh is NULL, it is used on line 3450:
clear_buffer_journaled(bh);
and lines 3453-3456:
clear_buffer_journal_dirty(bh);
clear_buffer_dirty(bh);
clear_buffer_journal_test(bh);
put_bh(bh);

Thus, possible null-pointer dereferences may occur.

To fix these bugs, bh is checked before being used.

These bugs are found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
---
fs/reiserfs/journal.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 4517a1394c6f..d115578597b6 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -3444,12 +3444,13 @@ static int remove_from_transaction(struct super_block *sb,
if (cn == journal->j_last) {
journal->j_last = cn->prev;
}
- if (bh)
+ if (bh) {
remove_journal_hash(sb, journal->j_hash_table, NULL,
bh->b_blocknr, 0);
- clear_buffer_journaled(bh); /* don't log this one */
+ clear_buffer_journaled(bh); /* don't log this one */
+ }

- if (!already_cleaned) {
+ if (!already_cleaned && bh) {
clear_buffer_journal_dirty(bh);
clear_buffer_dirty(bh);
clear_buffer_journal_test(bh);
--
2.17.0
\
 
 \ /
  Last update: 2019-07-26 10:38    [W:0.034 / U:45.184 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site