lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.4 096/100] reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
    Date
    From: Yunfeng Ye <yeyunfeng@huawei.com>

    [ Upstream commit aacee5446a2a1aa35d0a49dab289552578657fb4 ]

    The variable inode may be NULL in reiserfs_insert_item(), but there is
    no check before accessing the member of inode.

    Fix this by adding NULL pointer check before calling reiserfs_debug().

    Link: http://lkml.kernel.org/r/79c5135d-ff25-1cc9-4e99-9f572b88cc00@huawei.com
    Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
    Cc: zhengbin <zhengbin13@huawei.com>
    Cc: Hu Shiyuan <hushiyuan@huawei.com>
    Cc: Feilong Lin <linfeilong@huawei.com>
    Cc: Jan Kara <jack@suse.cz>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/reiserfs/stree.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
    index 24cbe013240fa..e3a4cbad9620c 100644
    --- a/fs/reiserfs/stree.c
    +++ b/fs/reiserfs/stree.c
    @@ -2249,7 +2249,8 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
    /* also releases the path */
    unfix_nodes(&s_ins_balance);
    #ifdef REISERQUOTA_DEBUG
    - reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
    + if (inode)
    + reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
    "reiserquota insert_item(): freeing %u id=%u type=%c",
    quota_bytes, inode->i_uid, head2type(ih));
    #endif
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 17:29    [W:2.840 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site