]> Git Repo - linux.git/commit
fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()
authorJia-Ju Bai <[email protected]>
Mon, 7 Oct 2019 00:57:50 +0000 (17:57 -0700)
committerLinus Torvalds <[email protected]>
Mon, 7 Oct 2019 22:47:19 +0000 (15:47 -0700)
commit56e94ea132bb5c2c1d0b60a6aeb34dcb7d71a53d
tree3fe025b19f43bfe824b95256f2ad92a682cb754c
parent7a243c82ea527cd1da47381ad9cd646844f3b693
fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()

In ocfs2_xa_prepare_entry(), there is an if statement on line 2136 to
check whether loc->xl_entry is NULL:

    if (loc->xl_entry)

When loc->xl_entry is NULL, it is used on line 2158:

    ocfs2_xa_add_entry(loc, name_hash);
        loc->xl_entry->xe_name_hash = cpu_to_le32(name_hash);
        loc->xl_entry->xe_name_offset = cpu_to_le16(loc->xl_size);

and line 2164:

    ocfs2_xa_add_namevalue(loc, xi);
        loc->xl_entry->xe_value_size = cpu_to_le64(xi->xi_value_len);
        loc->xl_entry->xe_name_len = xi->xi_name_len;

Thus, possible null-pointer dereferences may occur.

To fix these bugs, if loc-xl_entry is NULL, ocfs2_xa_prepare_entry()
abnormally returns with -EINVAL.

These bugs are found by a static analysis tool STCheck written by us.

[[email protected]: remove now-unused ocfs2_xa_add_entry()]
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Jia-Ju Bai <[email protected]>
Reviewed-by: Joseph Qi <[email protected]>
Cc: Mark Fasheh <[email protected]>
Cc: Joel Becker <[email protected]>
Cc: Junxiao Bi <[email protected]>
Cc: Changwei Ge <[email protected]>
Cc: Gang He <[email protected]>
Cc: Jun Piao <[email protected]>
Cc: Stephen Rothwell <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
fs/ocfs2/xattr.c
This page took 0.052615 seconds and 4 git commands to generate.