Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 297fae4d authored by Artem Savkov's avatar Artem Savkov Committed by Trond Myklebust
Browse files

Fix NULL pointer dereference in bl_free_device(). 



When bl_parse_deviceid() fails in bl_alloc_deviceid_node() on
blkdev_get_by_*() step we get an pnfs_block_dev struct that is
uninitialized except for bdev field which is set to whatever error
blkdev_get_by_*() returns.  bl_free_device() then tries to call
blkdev_put() if bdev is not 0 resulting in a wrong pointer dereference.

Fixing this by setting bdev in struct pnfs_block_dev only if we didn't
get an error from blkdev_get_by_*().

Signed-off-by: default avatarArtem Savkov <asavkov@redhat.com>
Reviewed-by: default avatarBenjamin Coddington <bcodding@redhat.com>
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
parent c77efc1e

fs/nfs/blocklayout/dev.c

+13 −9
Original line number Original line Diff line number Diff line
@@ -235,18 +235,20 @@ bl_parse_simple(struct nfs_server *server, struct pnfs_block_dev *d, 
		struct pnfs_block_volume *volumes, int idx, gfp_t gfp_mask)

		struct pnfs_block_volume *volumes, int idx, gfp_t gfp_mask)

{

{

	struct pnfs_block_volume *v = &volumes[idx];

	struct pnfs_block_volume *v = &volumes[idx];

	struct block_device *bdev;

	dev_t dev;

	dev_t dev;





	dev = bl_resolve_deviceid(server, v, gfp_mask);

	dev = bl_resolve_deviceid(server, v, gfp_mask);

	if (!dev)

	if (!dev)

		return -EIO;

		return -EIO;





	d->bdev = blkdev_get_by_dev(dev, FMODE_READ | FMODE_WRITE, NULL);

	bdev = blkdev_get_by_dev(dev, FMODE_READ | FMODE_WRITE, NULL);

	if (IS_ERR(d->bdev)) {

	if (IS_ERR(bdev)) {

		printk(KERN_WARNING "pNFS: failed to open device %d:%d (%ld)\n",

		printk(KERN_WARNING "pNFS: failed to open device %d:%d (%ld)\n",

			MAJOR(dev), MINOR(dev), PTR_ERR(d->bdev));

			MAJOR(dev), MINOR(dev), PTR_ERR(bdev));

		return PTR_ERR(d->bdev);

		return PTR_ERR(bdev);

	}

	}

	d->bdev = bdev;









	d->len = i_size_read(d->bdev->bd_inode);

	d->len = i_size_read(d->bdev->bd_inode);
@@ -350,17 +352,19 @@ bl_parse_scsi(struct nfs_server *server, struct pnfs_block_dev *d, 
		struct pnfs_block_volume *volumes, int idx, gfp_t gfp_mask)

		struct pnfs_block_volume *volumes, int idx, gfp_t gfp_mask)

{

{

	struct pnfs_block_volume *v = &volumes[idx];

	struct pnfs_block_volume *v = &volumes[idx];

	struct block_device *bdev;

	const struct pr_ops *ops;

	const struct pr_ops *ops;

	int error;

	int error;





	if (!bl_validate_designator(v))

	if (!bl_validate_designator(v))

		return -EINVAL;

		return -EINVAL;





	d->bdev = bl_open_dm_mpath_udev_path(v);

	bdev = bl_open_dm_mpath_udev_path(v);

	if (IS_ERR(d->bdev))

	if (IS_ERR(bdev))

		d->bdev = bl_open_udev_path(v);

		bdev = bl_open_udev_path(v);

	if (IS_ERR(d->bdev))

	if (IS_ERR(bdev))

		return PTR_ERR(d->bdev);

		return PTR_ERR(bdev);

	d->bdev = bdev;





	d->len = i_size_read(d->bdev->bd_inode);

	d->len = i_size_read(d->bdev->bd_inode);

	d->map = bl_map_simple;

	d->map = bl_map_simple;