Messages in this thread Patch in this message | | | From | "Timo Kamph" <> | Date | Thu, 27 Nov 2003 02:10:19 +0100 | Subject | Re: [BUG]Missing i_sb NULL pointer check in destroy_inode() |
| |
On 26 Nov 2003 at 14:09, Mingming Cao wrote: > On Tue, 2003-11-25 at 00:36, Christoph Hellwig wrote: > > On Mon, Nov 24, 2003 at 11:00:38AM -0800, Mingming Cao wrote: > > > Hello, Andrew, Marcelo, > > > > > > destroy_inode() dereferences inode->i_sb without checking if it is NULL. > > > This is inconsistent with its caller: iput() and clear_inode(), both of > > > which check inode->i_sb before dereferencing it. Since iput() calls > > > destroy_inode() after calling file system's .clear_inode method(via > > > clear_inode()), some file systems might choose to clear the i_sb in the > > > .clear_inode super block operation. This results in a crash in > > > destroy_inode(). > > > > > > This issue exists in both 2.6, 2.4 and 2.4 kernel. A simple fix against > > > 2.6.0-test9 is included below. 2.4 based fix should be very similar to > > > this one. Please take a look and consider include it. > > > > inode->i_sb can't be NULL. We should remove all those checks. > > > Sorry I can not agree with this. Maybe the inode->i_sb should not be > NULL, but the kernel still allows the file system to do so. In fact > JFS's diReadSpecial() function clears the inode->i_sb to NULL before > calling iput(). > > Acutally iput() in 2.6 is missing the check too.(in 2.4 the check is > there). Here is the the incremental fix for 2.6 only:
There is a little typo in your patch. The struct member is s_op and not op. The following patch should be right.
Timo
diff -urNp linux-2.6.0-test10/fs/inode.c a/fs/inode.c --- linux-2.6.0-test10/fs/inode.c 2003-11-23 17:33:24.000000000 -0800 +++ a/fs/inode.c 2003-11-26 13:59:34.000000000 -0800 @@ -1084,13 +1084,13 @@ static inline void iput_final(struct ino void iput(struct inode *inode) { if (inode) { - struct super_operations *op = inode->i_sb->s_op; - + struct super_block *sb = inode->i_sb; + if (inode->i_state == I_CLEAR) BUG(); - if (op && op->put_inode) - op->put_inode(inode); + if (sb && sb->s_op && sb->s_op->put_inode) + sb->s_op->put_inode(inode); if (atomic_dec_and_lock(&inode->i_count, &inode_lock)) iput_final(inode);
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |