]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
jfs: prevent NULL deref in diFree
authorHaimin Zhang <tcs_kernel@tencent.com>
Tue, 22 Mar 2022 13:59:17 +0000 (21:59 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 15 Apr 2022 12:15:04 +0000 (14:15 +0200)
commit2ef74e3e0089b6615ee124e1183746974c6bb561
tree1b6d1efd9e62b44bc5b8643066da3f06130f4832
parent0f3d824bd70a1303464d5e93ee3e7afe7832fe89
jfs: prevent NULL deref in diFree

[ Upstream commit a53046291020ec41e09181396c1e829287b48d47 ]

Add validation check for JFS_IP(ipimap)->i_imap to prevent a NULL deref
in diFree since diFree uses it without do any validations.
When function jfs_mount calls diMount to initialize fileset inode
allocation map, it can fail and JFS_IP(ipimap)->i_imap won't be
initialized. Then it calls diFreeSpecial to close fileset inode allocation
map inode and it will flow into jfs_evict_inode. Function jfs_evict_inode
just validates JFS_SBI(inode->i_sb)->ipimap, then calls diFree. diFree use
JFS_IP(ipimap)->i_imap directly, then it will cause a NULL deref.

Reported-by: TCS Robot <tcs_robot@tencent.com>
Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/jfs/inode.c