diff options
| author | Haimin Zhang <tcs_kernel@tencent.com> | 2022-03-22 16:59:17 +0300 |
|---|---|---|
| committer | Dave Kleikamp <dave.kleikamp@oracle.com> | 2022-03-22 18:09:19 +0300 |
| commit | a53046291020ec41e09181396c1e829287b48d47 (patch) | |
| tree | 75c5fe996ec52f270cb196cf41c8f6756cf80b3c /include/linux/nfs_fs_sb.h | |
| parent | 2cc7cc01c15f57d056318c33705647f87dcd4aab (diff) | |
| download | linux-a53046291020ec41e09181396c1e829287b48d47.tar.xz | |
jfs: prevent NULL deref in diFree
Add validation check for JFS_IP(ipimap)->i_imap to prevent a NULL deref
in diFree since diFree uses it without do any validations.
When function jfs_mount calls diMount to initialize fileset inode
allocation map, it can fail and JFS_IP(ipimap)->i_imap won't be
initialized. Then it calls diFreeSpecial to close fileset inode allocation
map inode and it will flow into jfs_evict_inode. Function jfs_evict_inode
just validates JFS_SBI(inode->i_sb)->ipimap, then calls diFree. diFree use
JFS_IP(ipimap)->i_imap directly, then it will cause a NULL deref.
Reported-by: TCS Robot <tcs_robot@tencent.com>
Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Diffstat (limited to 'include/linux/nfs_fs_sb.h')
0 files changed, 0 insertions, 0 deletions