lkml.org 
[lkml]   [2020]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.5 307/399] btrfs: fix possible NULL-pointer dereference in integrity checks
    Date
    From: Johannes Thumshirn <jth@kernel.org>

    [ Upstream commit 3dbd351df42109902fbcebf27104149226a4fcd9 ]

    A user reports a possible NULL-pointer dereference in
    btrfsic_process_superblock(). We are assigning state->fs_info to a local
    fs_info variable and afterwards checking for the presence of state.

    While we would BUG_ON() a NULL state anyways, we can also just remove
    the local fs_info copy, as fs_info is only used once as the first
    argument for btrfs_num_copies(). There we can just pass in
    state->fs_info as well.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=205003
    Signed-off-by: Johannes Thumshirn <jth@kernel.org>
    Reviewed-by: David Sterba <dsterba@suse.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/btrfs/check-integrity.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
    index 0b52ab4cb9649..72c70f59fc605 100644
    --- a/fs/btrfs/check-integrity.c
    +++ b/fs/btrfs/check-integrity.c
    @@ -629,7 +629,6 @@ static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(dev_t dev,
    static int btrfsic_process_superblock(struct btrfsic_state *state,
    struct btrfs_fs_devices *fs_devices)
    {
    - struct btrfs_fs_info *fs_info = state->fs_info;
    struct btrfs_super_block *selected_super;
    struct list_head *dev_head = &fs_devices->devices;
    struct btrfs_device *device;
    @@ -700,7 +699,7 @@ static int btrfsic_process_superblock(struct btrfsic_state *state,
    break;
    }

    - num_copies = btrfs_num_copies(fs_info, next_bytenr,
    + num_copies = btrfs_num_copies(state->fs_info, next_bytenr,
    state->metablock_size);
    if (state->print_mask & BTRFSIC_PRINT_MASK_NUM_COPIES)
    pr_info("num_copies(log_bytenr=%llu) = %d\n",
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-02-21 09:42    [W:2.834 / U:0.688 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site