mm: Check NULL pointer Dereference in mm/filemap.c
Subsystems (2)
PATCH 1/1 mm: Check NULL pointer Dereference in mm/filemap.c
mapping->a_ops->direct_IO() is not checked, if it's a NULL pointer, that will casue an oops. pagecache_write_begin/end is exported to other functions, so they need to check null pointer before use them.
--- mm/filemap.c | 13 +++++++++++++ 1 files changed, 13 insertions(+), 0 deletions(-)
mm/filemap.c +13 -0
@@ -1300,6 +1300,9 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov, retval =filemap_write_and_wait_range (mapping, pos, pos +iov_length (iov, nr_segs) -1 );if (!retval) { +if (unlikely (!mapping->a_ops || + !mapping->a_ops->direct_IO)) + goto out; retval = mapping->a_ops->direct_IO (READ , iocb, iov, pos, nr_segs); }
@@ -1581,6 +1584,8 @@ retry_find:return ret |VM_FAULT_LOCKED ; no_cached_page: +if (unlikely (!mapping->a_ops || !mapping->a_ops->readpage)) +return VM_FAULT_SIGBUS ;/* * We're only likely to ever get here if MADV_RANDOM is in * effect.
@@ -2103,6 +2108,8 @@ int pagecache_write_begin(struct file *file, struct address_space *mapping, {const struct address_space_operations *aops = mapping->a_ops; +if (unlikely (!aops || !aops->write_begin)) +return -EINVAL ;return aops->write_begin (file, mapping, pos, len, flags, pagep, fsdata); }
@@ -2114,6 +2121,9 @@ int pagecache_write_end(struct file *file, struct address_space *mapping, {const struct address_space_operations *aops = mapping->a_ops; +if (unlikely (!aops || !aops->write_end)) +return -EINVAL ; +mark_page_accessed (page);return aops->write_end (file, mapping, pos, len, copied, page, fsdata); }
@@ -2161,6 +2171,9 @@ generic_file_direct_write(struct kiocb *iocb, const struct iovec *iov, } } +if (unlikely (!mapping->a_ops || !mapping->a_ops->direct_IO)) + goto out; + written = mapping->a_ops->direct_IO (WRITE , iocb, iov, pos, *nr_segs);/*
Signature · 7 lines
1.6.5.3 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Andrew Morton
maintainerQuoted 4 lines · On Mon, 26 Jul 2010 16:25:42 +0800 [email protected] wrote:
mapping->a_ops->direct_IO()is not checked, if it's a NULL pointer, that will casue an oops. pagecache_write_begin/end is exported to other functions, so they need to check null pointer before use them.
The patch checks a lot more things than ->directIO!
It would be best to not add this overhead if possible. Did you actually observe an oops? If so, please fully describe it.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>