diff options
author | Chao Yu <yuchao0@huawei.com> | 2020-02-24 14:20:17 +0300 |
---|---|---|
committer | Jaegeuk Kim <jaegeuk@kernel.org> | 2020-02-27 21:16:45 +0300 |
commit | 61fbae2b2b1201525f8f0f35e0bdf6dfa8ec8541 (patch) | |
tree | bd424464621dfcd8161f2a5311ead8516f12e37f | |
parent | 7fa6d59816e7d81cfd4f854468c477c12b85c789 (diff) | |
download | linux-61fbae2b2b1201525f8f0f35e0bdf6dfa8ec8541.tar.xz |
f2fs: fix to avoid NULL pointer dereference
Unable to handle kernel NULL pointer dereference at virtual address 00000000
PC is at f2fs_free_dic+0x60/0x2c8
LR is at f2fs_decompress_pages+0x3c4/0x3e8
f2fs_free_dic+0x60/0x2c8
f2fs_decompress_pages+0x3c4/0x3e8
__read_end_io+0x78/0x19c
f2fs_post_read_work+0x6c/0x94
process_one_work+0x210/0x48c
worker_thread+0x2e8/0x44c
kthread+0x110/0x120
ret_from_fork+0x10/0x18
In f2fs_free_dic(), we can not use f2fs_put_page(,1) to release dic->tpages[i],
as the page's mapping is NULL.
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-rw-r--r-- | fs/f2fs/compress.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c index ef7dd04312fe..dde8ca08e94d 100644 --- a/fs/f2fs/compress.c +++ b/fs/f2fs/compress.c @@ -1137,7 +1137,8 @@ void f2fs_free_dic(struct decompress_io_ctx *dic) for (i = 0; i < dic->cluster_size; i++) { if (dic->rpages[i]) continue; - f2fs_put_page(dic->tpages[i], 1); + unlock_page(dic->tpages[i]); + put_page(dic->tpages[i]); } kfree(dic->tpages); } |