From patchwork Tue Jul 19 15:39:04 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Artem Savkov X-Patchwork-Id: 9237739 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 456B260867 for ; Tue, 19 Jul 2016 15:40:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 368152624C for ; Tue, 19 Jul 2016 15:40:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2459626929; Tue, 19 Jul 2016 15:40:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C256E26D19 for ; Tue, 19 Jul 2016 15:40:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753803AbcGSPjz (ORCPT ); Tue, 19 Jul 2016 11:39:55 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37487 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753873AbcGSPjz (ORCPT ); Tue, 19 Jul 2016 11:39:55 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 0CD7A7F7D5; Tue, 19 Jul 2016 15:39:54 +0000 (UTC) Received: from shodan.usersys.redhat.com (dhcp-1-150.brq.redhat.com [10.34.1.150]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u6JFdrkt024692; Tue, 19 Jul 2016 11:39:53 -0400 Received: by shodan.usersys.redhat.com (Postfix, from userid 1000) id 9CAB92C1A4E; Tue, 19 Jul 2016 17:39:52 +0200 (CEST) From: Artem Savkov To: Anna Schumaker Cc: linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org, trond.myklebust@primarydata.com, hch@lst.de, Artem Savkov Subject: [PATCH v2] Fix NULL pointer dereference in bl_free_device(). Date: Tue, 19 Jul 2016 17:39:04 +0200 Message-Id: <1468942744-10646-1-git-send-email-asavkov@redhat.com> In-Reply-To: References: X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Tue, 19 Jul 2016 15:39:54 +0000 (UTC) Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When bl_parse_deviceid() fails in bl_alloc_deviceid_node() on blkdev_get_by_*() step we get an pnfs_block_dev struct that is uninitialized except for bdev field which is set to whatever error blkdev_get_by_*() returns. bl_free_device() then tries to call blkdev_put() if bdev is not 0 resulting in a wrong pointer dereference. Fixing this by making sure bdev is not an error code in bl_free_device(). Signed-off-by: Artem Savkov --- fs/nfs/blocklayout/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c index 118252f..57cb800 100644 --- a/fs/nfs/blocklayout/dev.c +++ b/fs/nfs/blocklayout/dev.c @@ -33,7 +33,7 @@ bl_free_device(struct pnfs_block_dev *dev) pr_err("failed to unregister PR key.\n"); } - if (dev->bdev) + if (!IS_ERR_OR_NULL(dev->bdev)) blkdev_put(dev->bdev, FMODE_READ | FMODE_WRITE); } }