linux-kernel - [PATCH] btrfs: fix potential null pointer dereference bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1358609265-347-1-git-send-email-dinggnu@gmail.com>
Date:	Sat, 19 Jan 2013 16:27:45 +0100
From:	Cong Ding <dinggnu@...il.com>
To:	Chris Mason <chris.mason@...ionio.com>,
	linux-btrfs@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:	Cong Ding <dinggnu@...il.com>
Subject: [PATCH] btrfs: fix potential null pointer dereference bug

The bug happens when rb_node == NULL. It causes variable node to be NULL and
then the NULL pointer is dereferenced this line:
	BUG_ON((struct btrfs_root *)node->data != root);

Based on my analysis, function tree_search should not return NULL to variable
rb_node in this case (otherwise here has to be something unknown thing wrong),
so I replace "if (rb_node)" with UG_ON(!rb_node).

Signed-off-by: Cong Ding <dinggnu@...il.com>
---
 fs/btrfs/relocation.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 17c306b..d674671 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1263,10 +1263,11 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
 	spin_lock(&rc->reloc_root_tree.lock);
 	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
 			      root->commit_root->start);
-	if (rb_node) {
-		node = rb_entry(rb_node, struct mapping_node, rb_node);
-		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
-	}
+	BUG_ON(!rb_node);
+
+	node = rb_entry(rb_node, struct mapping_node, rb_node);
+	rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
+
 	spin_unlock(&rc->reloc_root_tree.lock);
 
 	BUG_ON((struct btrfs_root *)node->data != root);
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/