* [PATCH AUTOSEL 4.9 057/141] reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
[not found] <20200214162122.19794-1-sashal@kernel.org>
@ 2020-02-14 16:19 ` Sasha Levin
2020-02-14 16:21 ` [PATCH AUTOSEL 4.9 134/141] reiserfs: prevent NULL pointer dereference in reiserfs_insert_item() Sasha Levin
1 sibling, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2020-02-14 16:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jan Kara, Sasha Levin, reiserfs-devel
From: Jan Kara <jack@suse.cz>
[ Upstream commit 4d5c1adaf893b8aa52525d2b81995e949bcb3239 ]
When we fail to allocate string for journal device name we jump to
'error' label which tries to unlock reiserfs write lock which is not
held. Jump to 'error_unlocked' instead.
Fixes: f32485be8397 ("reiserfs: delay reiserfs lock until journal initialization")
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/reiserfs/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index bfed2a7000154..677608a89b08d 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1928,7 +1928,7 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
if (!sbi->s_jdev) {
SWARN(silent, s, "", "Cannot allocate memory for "
"journal device name");
- goto error;
+ goto error_unlocked;
}
}
#ifdef CONFIG_QUOTA
--
2.20.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* [PATCH AUTOSEL 4.9 134/141] reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
[not found] <20200214162122.19794-1-sashal@kernel.org>
2020-02-14 16:19 ` [PATCH AUTOSEL 4.9 057/141] reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling Sasha Levin
@ 2020-02-14 16:21 ` Sasha Levin
1 sibling, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2020-02-14 16:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Yunfeng Ye, zhengbin, Hu Shiyuan, Feilong Lin, Jan Kara,
Andrew Morton, Linus Torvalds, Sasha Levin, reiserfs-devel
From: Yunfeng Ye <yeyunfeng@huawei.com>
[ Upstream commit aacee5446a2a1aa35d0a49dab289552578657fb4 ]
The variable inode may be NULL in reiserfs_insert_item(), but there is
no check before accessing the member of inode.
Fix this by adding NULL pointer check before calling reiserfs_debug().
Link: http://lkml.kernel.org/r/79c5135d-ff25-1cc9-4e99-9f572b88cc00@huawei.com
Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
Cc: zhengbin <zhengbin13@huawei.com>
Cc: Hu Shiyuan <hushiyuan@huawei.com>
Cc: Feilong Lin <linfeilong@huawei.com>
Cc: Jan Kara <jack@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/reiserfs/stree.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
index a97e352d05d3b..5f5fff0688776 100644
--- a/fs/reiserfs/stree.c
+++ b/fs/reiserfs/stree.c
@@ -2249,7 +2249,8 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
/* also releases the path */
unfix_nodes(&s_ins_balance);
#ifdef REISERQUOTA_DEBUG
- reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
+ if (inode)
+ reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
"reiserquota insert_item(): freeing %u id=%u type=%c",
quota_bytes, inode->i_uid, head2type(ih));
#endif
--
2.20.1
^ permalink raw reply related [flat|nested] 2+ messages in thread