Messages in this thread | | | From | Li Tuo <> | Subject | [BUG] jffs2: possible null-pointer dereference in jffs2_scan_dirty_space() | Date | Sat, 31 Jul 2021 12:05:47 +0800 |
| |
Hello,
Our static analysis tool finds a possible null-pointer dereference in the jffs2 driver in Linux 5.14.0-rc3:
The variable jeb->last_node is checked in: 673: if (jeb->last_node && ref_obsolete(jeb->last_node))
This indicates that jeb->last_node can be NULL. If so, the function jffs2_link_node_ref() is called with the argument jeb: 685: jffs2_link_node_ref(c, jeb, ofs, size, NULL);
In the called function, jeb->last_node is assigned to the pointer ref, which means ref is also NULL. However, the possible NULL pointer ref is dereferenced in some statements such as: 597: dbg_noderef("Last node at %p is (%08x,%p)\n", ref, ref->flash_offset, ref->next_in_ino); 600: while (ref->flash_offset != REF_EMPTY_NODE)
I am not quite sure whether this possible null-pointer dereference is real and how to fix it if it is real. Any feedback would be appreciated, thanks!
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Best wishes, Tuo Li
| |