lkml.org 
[lkml]   [2022]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] fs: jfs: fix possible NULL pointer dereference in dbFree()
From
Thanks for the fix! It's in the queue.

Shaggy

On 4/11/22 5:45AM, Zixuan Fu wrote:
> In our fault-injection testing, the variable "nblocks" in dbFree() can be
> zero when kmalloc_array() fails in dtSearch(). In this case, the variable
> "mp" in dbFree() would be NULL and then it is dereferenced in
> "write_metapage(mp)".
>
> The failure log is listed as follows:
>
> [ 13.824137] BUG: kernel NULL pointer dereference, address: 0000000000000020
> ...
> [ 13.827416] RIP: 0010:dbFree+0x5f7/0x910 [jfs]
> [ 13.834341] Call Trace:
> [ 13.834540] <TASK>
> [ 13.834713] txFreeMap+0x7b4/0xb10 [jfs]
> [ 13.835038] txUpdateMap+0x311/0x650 [jfs]
> [ 13.835375] jfs_lazycommit+0x5f2/0xc70 [jfs]
> [ 13.835726] ? sched_dynamic_update+0x1b0/0x1b0
> [ 13.836092] kthread+0x3c2/0x4a0
> [ 13.836355] ? txLockFree+0x160/0x160 [jfs]
> [ 13.836763] ? kthread_unuse_mm+0x160/0x160
> [ 13.837106] ret_from_fork+0x1f/0x30
> [ 13.837402] </TASK>
> ...
>
> This patch adds a NULL check of "mp" before "write_metapage(mp)" is called.
>
> Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
> Signed-off-by: Zixuan Fu <r33s3n6@gmail.com>
> ---
> fs/jfs/jfs_dmap.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index d8502f4989d9..e75f31b81d63 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -385,7 +385,8 @@ int dbFree(struct inode *ip, s64 blkno, s64 nblocks)
> }
>
> /* write the last buffer. */
> - write_metapage(mp);
> + if (mp)
> + write_metapage(mp);
>
> IREAD_UNLOCK(ipbmap);
>

\
 
 \ /
  Last update: 2022-04-19 17:26    [W:0.037 / U:0.760 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site