Messages in this thread | | | Date | Tue, 19 Apr 2022 10:23:43 -0500 | Subject | Re: [PATCH] fs: jfs: fix possible NULL pointer dereference in dbFree() | From | Dave Kleikamp <> |
| |
Thanks for the fix! It's in the queue.
Shaggy
On 4/11/22 5:45AM, Zixuan Fu wrote: > In our fault-injection testing, the variable "nblocks" in dbFree() can be > zero when kmalloc_array() fails in dtSearch(). In this case, the variable > "mp" in dbFree() would be NULL and then it is dereferenced in > "write_metapage(mp)". > > The failure log is listed as follows: > > [ 13.824137] BUG: kernel NULL pointer dereference, address: 0000000000000020 > ... > [ 13.827416] RIP: 0010:dbFree+0x5f7/0x910 [jfs] > [ 13.834341] Call Trace: > [ 13.834540] <TASK> > [ 13.834713] txFreeMap+0x7b4/0xb10 [jfs] > [ 13.835038] txUpdateMap+0x311/0x650 [jfs] > [ 13.835375] jfs_lazycommit+0x5f2/0xc70 [jfs] > [ 13.835726] ? sched_dynamic_update+0x1b0/0x1b0 > [ 13.836092] kthread+0x3c2/0x4a0 > [ 13.836355] ? txLockFree+0x160/0x160 [jfs] > [ 13.836763] ? kthread_unuse_mm+0x160/0x160 > [ 13.837106] ret_from_fork+0x1f/0x30 > [ 13.837402] </TASK> > ... > > This patch adds a NULL check of "mp" before "write_metapage(mp)" is called. > > Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> > Signed-off-by: Zixuan Fu <r33s3n6@gmail.com> > --- > fs/jfs/jfs_dmap.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c > index d8502f4989d9..e75f31b81d63 100644 > --- a/fs/jfs/jfs_dmap.c > +++ b/fs/jfs/jfs_dmap.c > @@ -385,7 +385,8 @@ int dbFree(struct inode *ip, s64 blkno, s64 nblocks) > } > > /* write the last buffer. */ > - write_metapage(mp); > + if (mp) > + write_metapage(mp); > > IREAD_UNLOCK(ipbmap); >
| |