| From b759de4240785bdc852f30267780d6a203d084bb Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sun, 6 Oct 2019 17:57:57 -0700 |
| Subject: fs: ocfs2: fix a possible null-pointer dereference in |
| ocfs2_info_scan_inode_alloc() |
| |
| From: Jia-Ju Bai <baijiaju1990@gmail.com> |
| |
| [ Upstream commit 2abb7d3b12d007c30193f48bebed781009bebdd2 ] |
| |
| In ocfs2_info_scan_inode_alloc(), there is an if statement on line 283 |
| to check whether inode_alloc is NULL: |
| |
| if (inode_alloc) |
| |
| When inode_alloc is NULL, it is used on line 287: |
| |
| ocfs2_inode_lock(inode_alloc, &bh, 0); |
| ocfs2_inode_lock_full_nested(inode, ...) |
| struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); |
| |
| Thus, a possible null-pointer dereference may occur. |
| |
| To fix this bug, inode_alloc is checked on line 286. |
| |
| This bug is found by a static analysis tool STCheck written by us. |
| |
| Link: http://lkml.kernel.org/r/20190726033717.32359-1-baijiaju1990@gmail.com |
| Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> |
| Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> |
| Cc: Mark Fasheh <mark@fasheh.com> |
| Cc: Joel Becker <jlbec@evilplan.org> |
| Cc: Junxiao Bi <junxiao.bi@oracle.com> |
| Cc: Changwei Ge <gechangwei@live.cn> |
| Cc: Gang He <ghe@suse.com> |
| Cc: Jun Piao <piaojun@huawei.com> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| fs/ocfs2/ioctl.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c |
| index ab30c005cc4bc..9fa98abecfc6b 100644 |
| --- a/fs/ocfs2/ioctl.c |
| +++ b/fs/ocfs2/ioctl.c |
| @@ -290,7 +290,7 @@ static int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb, |
| if (inode_alloc) |
| inode_lock(inode_alloc); |
| |
| - if (o2info_coherent(&fi->ifi_req)) { |
| + if (inode_alloc && o2info_coherent(&fi->ifi_req)) { |
| status = ocfs2_inode_lock(inode_alloc, &bh, 0); |
| if (status < 0) { |
| mlog_errno(status); |
| -- |
| 2.20.1 |
| |