| Message ID | 1471967731-3465-1-git-send-email-aryabinin@virtuozzo.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Tue, Aug 23, 2016 at 06:55:31PM +0300, Andrey Ryabinin wrote: > Calling freeze_bdev() twice on the same block device without mounted > filesystem get_super() will return NULL, which will lead to NULL-ptr > dereference later in drop_super(). > > Check get_super() result to fix that. > > Note, that this is a purely theoretical issue. We have only 3 > freeze_bdev() callers. 2 of them are in filesystem code and used on a > device with mounted fs. The third one in lock_fs() has protection in > upper-layer code against freezing block device the second time without > thawing it first. > > Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Looks fine, Reviewed-by: Christoph Hellwig <hch@lst.de> -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 08/23/2016 09:55 AM, Andrey Ryabinin wrote: > Calling freeze_bdev() twice on the same block device without mounted > filesystem get_super() will return NULL, which will lead to NULL-ptr > dereference later in drop_super(). > > Check get_super() result to fix that. > > Note, that this is a purely theoretical issue. We have only 3 > freeze_bdev() callers. 2 of them are in filesystem code and used on a > device with mounted fs. The third one in lock_fs() has protection in > upper-layer code against freezing block device the second time without > thawing it first. Applied, thanks.
On 08/23/2016 09:55 AM, Andrey Ryabinin wrote: > Calling freeze_bdev() twice on the same block device without mounted > filesystem get_super() will return NULL, which will lead to NULL-ptr > dereference later in drop_super(). > > Check get_super() result to fix that. > > Note, that this is a purely theoretical issue. We have only 3 > freeze_bdev() callers. 2 of them are in filesystem code and used on a > device with mounted fs. The third one in lock_fs() has protection in > upper-layer code against freezing block device the second time without > thawing it first. Applied, thanks.
diff --git a/fs/block_dev.c b/fs/block_dev.c index c3cdde8..c18b083 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -249,7 +249,8 @@ struct super_block *freeze_bdev(struct block_device *bdev) * thaw_bdev drops it. */ sb = get_super(bdev); - drop_super(sb); + if (sb) + drop_super(sb); mutex_unlock(&bdev->bd_fsfreeze_mutex); return sb; }
Calling freeze_bdev() twice on the same block device without mounted filesystem get_super() will return NULL, which will lead to NULL-ptr dereference later in drop_super(). Check get_super() result to fix that. Note, that this is a purely theoretical issue. We have only 3 freeze_bdev() callers. 2 of them are in filesystem code and used on a device with mounted fs. The third one in lock_fs() has protection in upper-layer code against freezing block device the second time without thawing it first. Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> --- fs/block_dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)