Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1218135 > unrolled thread

[PATCH] xfs: fix null pointer dereference when mapping is NULL

Back to article view | Back to linux.kernel

Contents

  [PATCH] xfs: fix null pointer dereference when mapping is NULL Colin King <colin.king@canonical.com> - 2015-09-03 12:00 +0200
    Re: [PATCH] xfs: fix null pointer dereference when mapping is NULL Brian Foster <bfoster@redhat.com> - 2015-09-03 12:50 +0200
      Re: [PATCH] xfs: fix null pointer dereference when mapping is NULL Eric Sandeen <sandeen@sandeen.net> - 2015-09-03 16:00 +0200

#1218135 — [PATCH] xfs: fix null pointer dereference when mapping is NULL

From: Colin Ian King <colin.king@canonical.com>

xfs_vm_set_page_dirty checks to see if mapping is NULL however
before this unlikely check it already dereferenced mapping when
initializing inode. Move the inode initialization after the mapping
null check to avoid a potential null pointer dereference.

Fixes: 22e757a49cf0 ("xfs: don't dirty buffers beyond EOF")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 fs/xfs/xfs_aops.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index c77499b..d15ae85 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -1935,7 +1935,7 @@ xfs_vm_set_page_dirty(
 	struct page		*page)
 {
 	struct address_space	*mapping = page->mapping;
-	struct inode		*inode = mapping->host;
+	struct inode		*inode;
 	loff_t			end_offset;
 	loff_t			offset;
 	int			newly_dirty;
@@ -1944,6 +1944,7 @@ xfs_vm_set_page_dirty(
 	if (unlikely(!mapping))
 		return !TestSetPageDirty(page);
 
+	inode = mapping->host;
 	end_offset = i_size_read(inode);
 	offset = page_offset(page);
 
-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1218146

On Thu, Sep 03, 2015 at 10:57:40AM +0100, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
> 
> xfs_vm_set_page_dirty checks to see if mapping is NULL however
> before this unlikely check it already dereferenced mapping when
> initializing inode. Move the inode initialization after the mapping
> null check to avoid a potential null pointer dereference.
> 
> Fixes: 22e757a49cf0 ("xfs: don't dirty buffers beyond EOF")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---

Reviewed-by: Brian Foster <bfoster@redhat.com>

>  fs/xfs/xfs_aops.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
> index c77499b..d15ae85 100644
> --- a/fs/xfs/xfs_aops.c
> +++ b/fs/xfs/xfs_aops.c
> @@ -1935,7 +1935,7 @@ xfs_vm_set_page_dirty(
>  	struct page		*page)
>  {
>  	struct address_space	*mapping = page->mapping;
> -	struct inode		*inode = mapping->host;
> +	struct inode		*inode;
>  	loff_t			end_offset;
>  	loff_t			offset;
>  	int			newly_dirty;
> @@ -1944,6 +1944,7 @@ xfs_vm_set_page_dirty(
>  	if (unlikely(!mapping))
>  		return !TestSetPageDirty(page);
>  
> +	inode = mapping->host;
>  	end_offset = i_size_read(inode);
>  	offset = page_offset(page);
>  
> -- 
> 2.5.0
> 
> _______________________________________________
> xfs mailing list
> xfs@oss.sgi.com
> http://oss.sgi.com/mailman/listinfo/xfs
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1218260

On 9/3/15 5:45 AM, Brian Foster wrote:
> On Thu, Sep 03, 2015 at 10:57:40AM +0100, Colin King wrote:
>> From: Colin Ian King <colin.king@canonical.com>
>>
>> xfs_vm_set_page_dirty checks to see if mapping is NULL however
>> before this unlikely check it already dereferenced mapping when
>> initializing inode. Move the inode initialization after the mapping
>> null check to avoid a potential null pointer dereference.
>>
>> Fixes: 22e757a49cf0 ("xfs: don't dirty buffers beyond EOF")
>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>> ---
> 
> Reviewed-by: Brian Foster <bfoster@redhat.com>

Reviewed-by: Eric Sandeen <sandeen@redhat.com>

Should probably cc: stable on this one too, the commit it
fixes went in at 3.17, and it also cc'd stable.

-Eric

>>  fs/xfs/xfs_aops.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
>> index c77499b..d15ae85 100644
>> --- a/fs/xfs/xfs_aops.c
>> +++ b/fs/xfs/xfs_aops.c
>> @@ -1935,7 +1935,7 @@ xfs_vm_set_page_dirty(
>>  	struct page		*page)
>>  {
>>  	struct address_space	*mapping = page->mapping;
>> -	struct inode		*inode = mapping->host;
>> +	struct inode		*inode;
>>  	loff_t			end_offset;
>>  	loff_t			offset;
>>  	int			newly_dirty;
>> @@ -1944,6 +1944,7 @@ xfs_vm_set_page_dirty(
>>  	if (unlikely(!mapping))
>>  		return !TestSetPageDirty(page);
>>  
>> +	inode = mapping->host;
>>  	end_offset = i_size_read(inode);
>>  	offset = page_offset(page);
>>  
>> -- 
>> 2.5.0
>>
>> _______________________________________________
>> xfs mailing list
>> xfs@oss.sgi.com
>> http://oss.sgi.com/mailman/listinfo/xfs
> 
> _______________________________________________
> xfs mailing list
> xfs@oss.sgi.com
> http://oss.sgi.com/mailman/listinfo/xfs
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web