summaryrefslogtreecommitdiff
path: root/fs/jfs
diff options
context:
space:
mode:
authorHaimin Zhang <tcs_kernel@tencent.com>2022-03-22 16:59:17 +0300
committerDave Kleikamp <dave.kleikamp@oracle.com>2022-03-22 18:09:19 +0300
commita53046291020ec41e09181396c1e829287b48d47 (patch)
tree75c5fe996ec52f270cb196cf41c8f6756cf80b3c /fs/jfs
parent2cc7cc01c15f57d056318c33705647f87dcd4aab (diff)
downloadlinux-a53046291020ec41e09181396c1e829287b48d47.tar.xz
jfs: prevent NULL deref in diFree
Add validation check for JFS_IP(ipimap)->i_imap to prevent a NULL deref in diFree since diFree uses it without do any validations. When function jfs_mount calls diMount to initialize fileset inode allocation map, it can fail and JFS_IP(ipimap)->i_imap won't be initialized. Then it calls diFreeSpecial to close fileset inode allocation map inode and it will flow into jfs_evict_inode. Function jfs_evict_inode just validates JFS_SBI(inode->i_sb)->ipimap, then calls diFree. diFree use JFS_IP(ipimap)->i_imap directly, then it will cause a NULL deref. Reported-by: TCS Robot <tcs_robot@tencent.com> Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Diffstat (limited to 'fs/jfs')
-rw-r--r--fs/jfs/inode.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 57ab424c05ff..072821b50ab9 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -146,12 +146,13 @@ void jfs_evict_inode(struct inode *inode)
dquot_initialize(inode);
if (JFS_IP(inode)->fileset == FILESYSTEM_I) {
+ struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap;
truncate_inode_pages_final(&inode->i_data);
if (test_cflag(COMMIT_Freewmap, inode))
jfs_free_zero_link(inode);
- if (JFS_SBI(inode->i_sb)->ipimap)
+ if (ipimap && JFS_IP(ipimap)->i_imap)
diFree(inode);
/*