Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 01239d77 authored by Shan Hai's avatar Shan Hai Committed by Darrick J. Wong
Browse files

xfs: fix a null pointer dereference in xfs_bmap_extents_to_btree 



Fuzzing tool reports a write to null pointer error in the
xfs_bmap_extents_to_btree, fix it by bailing out on encountering
a null pointer.

Signed-off-by: default avatarShan Hai <shan.hai@oracle.com>
Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
parent fa6c668d

fs/xfs/libxfs/xfs_bmap.c

+16 −8
Original line number Diff line number Diff line
@@ -712,19 +712,14 @@ xfs_bmap_extents_to_btree( 
	args.wasdel = wasdel;

	*logflagsp = 0;

	if ((error = xfs_alloc_vextent(&args))) {

		xfs_iroot_realloc(ip, -1, whichfork);

		ASSERT(ifp->if_broot == NULL);

		XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);

		xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);

		return error;

		goto err1;

	}



	if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {

		xfs_iroot_realloc(ip, -1, whichfork);

		ASSERT(ifp->if_broot == NULL);

		XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);

		xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);

		return -ENOSPC;

		error = -ENOSPC;

		goto err1;

	}

	/*

	 * Allocation can't fail, the space was reserved.
@@ -736,6 +731,10 @@ xfs_bmap_extents_to_btree( 
	ip->i_d.di_nblocks++;

	xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_BCOUNT, 1L);

	abp = xfs_btree_get_bufl(mp, tp, args.fsbno, 0);

	if (!abp) {

		error = -ENOSPC;

		goto err2;

	}

	/*

	 * Fill in the child block.

	 */
@@ -775,6 +774,15 @@ xfs_bmap_extents_to_btree( 
	*curp = cur;

	*logflagsp = XFS_ILOG_CORE | xfs_ilog_fbroot(whichfork);

	return 0;



err2:

	xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_BCOUNT, -1L);

err1:

	xfs_iroot_realloc(ip, -1, whichfork);

	XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);

	xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);



	return error;

}



/*