[PATCH] xfs: don't release NULL pip in xfs_filestream_lookup_ag()

[PATCH] xfs: don't release NULL pip in xfs_filestream_lookup_ag()

[Eric Sandeen]

If xfs_filestream_get_parent() fails, we have a null pip,
goto out, and attempt to IRELE(NULL).  This causes a null
pointer dereference and BUG().

Fix this by testing for pip before trying to release it.

Reported-by: Adrien Nader <adrien@notk.org>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---

diff --git a/fs/xfs/xfs_filestream.c b/fs/xfs/xfs_filestream.c
index a2e86e8..fb09a63 100644
--- a/fs/xfs/xfs_filestream.c
+++ b/fs/xfs/xfs_filestream.c
@@ -348,7 +348,8 @@ xfs_filestream_lookup_ag(
 	if (xfs_filestream_pick_ag(pip, startag, &ag, 0, 0))
 		ag = NULLAGNUMBER;
 out:
-	IRELE(pip);
+	if (pip)
+		IRELE(pip);
 	return ag;
 }
 

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: [PATCH] xfs: don't release NULL pip in xfs_filestream_lookup_ag()

[Dave Chinner]

On Tue, Mar 03, 2015 at 02:14:57PM -0600, Eric Sandeen wrote:
> If xfs_filestream_get_parent() fails, we have a null pip,
> goto out, and attempt to IRELE(NULL).  This causes a null
> pointer dereference and BUG().
> 
> Fix this by testing for pip before trying to release it.
> 
> Reported-by: Adrien Nader <adrien@notk.org>
> Signed-off-by: Eric Sandeen <sandeen@redhat.com>
> ---
> 
> diff --git a/fs/xfs/xfs_filestream.c b/fs/xfs/xfs_filestream.c
> index a2e86e8..fb09a63 100644
> --- a/fs/xfs/xfs_filestream.c
> +++ b/fs/xfs/xfs_filestream.c
> @@ -348,7 +348,8 @@ xfs_filestream_lookup_ag(
>  	if (xfs_filestream_pick_ag(pip, startag, &ag, 0, 0))
>  		ag = NULLAGNUMBER;
>  out:
> -	IRELE(pip);
> +	if (pip)
> +		IRELE(pip);
>  	return ag;
>  }
>  

I'd just convert the error case when get_parent fails to:

	if (!pip)
		return NULLAGNUMBER;

rather than using the goto and adding conditional cleanup for this
case.

Cheers,

Dave.
-- 
Dave Chinner
david@fromorbit.com

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

[PATCH V2] xfs: fix NULL pointer dereference in xfs_filestream_lookup_ag()

[Eric Sandeen]

If xfs_filestream_get_parent() fails, we have a null pip,
goto out, and attempt to IRELE(NULL).  This causes a null
pointer dereference and BUG().

Fix this by directly returning NULLAGNUMBER in this case.

Reported-by: Adrien Nader <adrien@notk.org>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---

V2: skip the goto, because Dave doesn't like it.  ;)

diff --git a/fs/xfs/xfs_filestream.c b/fs/xfs/xfs_filestream.c
index a2e86e8..8f9f854 100644
--- a/fs/xfs/xfs_filestream.c
+++ b/fs/xfs/xfs_filestream.c
@@ -322,7 +322,7 @@ xfs_filestream_lookup_ag(
 
 	pip = xfs_filestream_get_parent(ip);
 	if (!pip)
-		goto out;
+		return NULLAGNUMBER;
 
 	mru = xfs_mru_cache_lookup(mp->m_filestream, pip->i_ino);
 	if (mru) {


_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs