dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

[XFS] Fix a potential NULL pointer deref in XFS on failed mount. 

If we fail to open the the log device buftarg, we can fall through to
error handling code that fails to check for a NULL log device buftarg
before calling xfs_free_buftarg().

This patch fixes the issue by checking mp->m_logdev_targp against NULL in
xfs_unmountfs_close() and doing the proper xfs_blkdev_put(logdev); and
xfs_blkdev_put(rtdev); on (!mp->m_rtdev_targp) in xfs_mount().

Discovered by the Coverity checker.

SGI-PV: 968563
SGI-Modid: xfs-linux-melb:xfs-kern:29328a

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: David Chinner <dgc@sgi.com>
Signed-off-by: Tim Shimmin <tes@sgi.com>
This commit is contained in:
Jesper Juhl 2007-08-16 16:25:42 +10:00 committed by Tim Shimmin
parent dcb3b83feb
commit 49ee6c911f
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/xfs/xfs_mount.c
View File

@ -1262,7 +1262,7 @@ xfs_unmountfs(xfs_mount_t *mp, struct cred *cr)
void
xfs_unmountfs_close(xfs_mount_t *mp, struct cred *cr)
{
if (mp->m_logdev_targp != mp->m_ddev_targp)
if (mp->m_logdev_targp && mp->m_logdev_targp != mp->m_ddev_targp)
xfs_free_buftarg(mp->m_logdev_targp, 1);
if (mp->m_rtdev_targp)
xfs_free_buftarg(mp->m_rtdev_targp, 1);

10
fs/xfs/xfs_vfsops.c
View File

@ -480,13 +480,19 @@ xfs_mount(
}
if (rtdev) {
mp->m_rtdev_targp = xfs_alloc_buftarg(rtdev, 1);
if (!mp->m_rtdev_targp)
if (!mp->m_rtdev_targp) {
xfs_blkdev_put(logdev);
xfs_blkdev_put(rtdev);
goto error0;
}
}
mp->m_logdev_targp = (logdev && logdev != ddev) ?
xfs_alloc_buftarg(logdev, 1) : mp->m_ddev_targp;
if (!mp->m_logdev_targp)
if (!mp->m_logdev_targp) {
xfs_blkdev_put(logdev);
xfs_blkdev_put(rtdev);
goto error0;
}
/*
* Setup flags based on mount(2) options and then the superblock