linux-kernel - [PATCH] fs: reiserfs: Fix possible null-pointer dereferences in remove_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190726083838.8301-1-baijiaju1990@gmail.com>
Date:   Fri, 26 Jul 2019 16:38:38 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     jack@...e.cz, akpm@...ux-foundation.org, arnd@...db.de,
        linux.bhar@...il.com, hariprasad.kelam@...il.com
Cc:     reiserfs-devel@...r.kernel.org, linux-kernel@...r.kernel.org,
        Jia-Ju Bai <baijiaju1990@...il.com>
Subject: [PATCH] fs: reiserfs: Fix possible null-pointer dereferences in remove_from_transaction()

In remove_from_transaction(), there is an if statement on line 3447 to
check whether bh is NULL:
    if (bh)

When bh is NULL, it is used on line 3450:
    clear_buffer_journaled(bh);
and lines 3453-3456:
    clear_buffer_journal_dirty(bh);
    clear_buffer_dirty(bh);
    clear_buffer_journal_test(bh);
    put_bh(bh);

Thus, possible null-pointer dereferences may occur.

To fix these bugs, bh is checked before being used.

These bugs are found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@...il.com>
---
 fs/reiserfs/journal.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 4517a1394c6f..d115578597b6 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -3444,12 +3444,13 @@ static int remove_from_transaction(struct super_block *sb,
 	if (cn == journal->j_last) {
 		journal->j_last = cn->prev;
 	}
-	if (bh)
+	if (bh) {
 		remove_journal_hash(sb, journal->j_hash_table, NULL,
 				    bh->b_blocknr, 0);
-	clear_buffer_journaled(bh);	/* don't log this one */
+		clear_buffer_journaled(bh);	/* don't log this one */
+	}
 
-	if (!already_cleaned) {
+	if (!already_cleaned && bh) {
 		clear_buffer_journal_dirty(bh);
 		clear_buffer_dirty(bh);
 		clear_buffer_journal_test(bh);
-- 
2.17.0