lkml.org 
[lkml]   [2013]   [Jan]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] btrfs: fix potential null pointer dereference bug
Date
The bug happens when rb_node == NULL. It causes variable node to be NULL and
then the NULL pointer is dereferenced this line:
BUG_ON((struct btrfs_root *)node->data != root);

Based on my analysis, function tree_search should not return NULL to variable
rb_node in this case (otherwise here has to be something unknown thing wrong),
so I replace "if (rb_node)" with UG_ON(!rb_node).

Signed-off-by: Cong Ding <dinggnu@gmail.com>
---
fs/btrfs/relocation.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 17c306b..d674671 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1263,10 +1263,11 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
spin_lock(&rc->reloc_root_tree.lock);
rb_node = tree_search(&rc->reloc_root_tree.rb_root,
root->commit_root->start);
- if (rb_node) {
- node = rb_entry(rb_node, struct mapping_node, rb_node);
- rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
- }
+ BUG_ON(!rb_node);
+
+ node = rb_entry(rb_node, struct mapping_node, rb_node);
+ rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
+
spin_unlock(&rc->reloc_root_tree.lock);

BUG_ON((struct btrfs_root *)node->data != root);
--
1.7.10.4


\
 
 \ /
  Last update: 2013-01-19 17:21    [W:0.047 / U:0.900 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site