Skip to contentSkip to conversation

ocfs2: fix NULL pointer dereference in function ocfs2_abort_trigger()

PATCH New Xue jiufei 2 participants 2 messages May 22, 2015 OCFS2

lore
Share & tools
lore

Xue jiufei

author
#0 lore raw

PATCH 1/1 ocfs2: fix NULL pointer dereference in function ocfs2_abort_trigger()

Function ocfs2_abort_trigger() use bh->b_assoc_map to get sb. But there's no function to set bh->b_assoc_map in ocfs2, it will trigger NULL pointer dereference while calling this function. We can get sb from bh->b_bdev->bd_super instead of b_assoc_map.

Signed-off-by joyce.xue <[email protected]>
---
 fs/ocfs2/journal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ocfs2/journal.c +1 -1
index ff53192..11cb383 100644
@@ -573,7 +573,7 @@ static void ocfs2_abort_trigger(struct jbd2_buffer_trigger_type *triggers,
 
 	/* We aren't guaranteed to have the superblock here - but if we
 	 * don't, it'll just crash. */
-	ocfs2_error(bh->b_assoc_map->host->i_sb,
+	ocfs2_error(bh->b_bdev->bd_super,
 		    "JBD2 has aborted our journal, ocfs2 cannot continue\n");
 }
Signature · 1 line
1.8.4.3
#1 lore raw

PATCH 1/1 ocfs2: fix NULL pointer dereference in function ocfs2_abort_trigger()

Quoted 16 lines · Xue jiufei

Function ocfs2_abort_trigger() use bh->b_assoc_map to get sb. But there's no function to set bh->b_assoc_map in ocfs2, it will trigger NULL pointer dereference while calling this function. We can get sb from bh->b_bdev->bd_super instead of b_assoc_map.

Signed-off-by joyce.xue <[email protected]>
---
 fs/ocfs2/journal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ocfs2/journal.c +0 -0
index ff53192..11cb383 100644

fs/ocfs2/journal.c static void ocfs2_abort_trigger(struct jbd2_buffer_trigger_type *triggers, · line 575

Quoted 3 lines
fs/ocfs2/journal.c +0 -0
@@ -573,7 +573,7 @@ static void ocfs2_abort_trigger(struct jbd2_buffer_trigger_type *triggers,
 
 	/* We aren't guaranteed to have the superblock here - but if we
 	 * don't, it'll just crash. */

Should we delete this comments correspondingly?

Quoted 6 lines
fs/ocfs2/journal.c +1 -1
-	ocfs2_error(bh->b_assoc_map->host->i_sb,
+	ocfs2_error(bh->b_bdev->bd_super,
 		    "JBD2 has aborted our journal, ocfs2 cannot continue\n");
 }