Commit 812c6796 authored Oct 12, 2014 by Amir Samuelov

dm: dm-req-crypt: fix null pointer reference



When dm_get_device(&dev) fails the "dev" variable is NULL,
so calling dm_put_device(dev) crash the device.

[  125.744115] [<ffffffc000837ecc>] dm_put_device+0x14/0x58
[  125.749408] [<ffffffc000843794>] req_crypt_dtr+0xa8/0xbc
[  125.754696] [<ffffffc000843bc0>] req_crypt_ctr+0x418/0x440
[  125.760176] [<ffffffc0008387fc>] dm_table_add_target+0x24c/0x2f8
[  125.766167] [<ffffffc00083bfac>] table_load+0x27c/0x2b0
[  125.771377] [<ffffffc00083b90c>] ctl_ioctl+0x3a8/0x448
[  125.776496] [<ffffffc00083b9bc>] dm_ctl_ioctl+0x10/0x20
[  125.781706] [<ffffffc000301cd0>] vfs_ioctl+0x20/0x3c
[  125.786648] [<ffffffc000302618>] do_vfs_ioctl+0x49c/0x568
[  125.792031] [<ffffffc000302740>] SyS_ioctl+0x5c/0x88

Change-Id: Icef2841b1aede259ee0f697f21b1976cd4485991
Signed-off-by: Amir Samuelov <amirs@codeaurora.org>

parent 7446700f

drivers/md/dm-req-crypt.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -867,7 +867,10 @@ static void req_crypt_dtr(struct dm_target *ti)
		destroy_workqueue(req_crypt_queue);
		req_crypt_queue = NULL;
		}
		if (dev) {
		dm_put_device(ti, dev);
		dev = NULL;
		}
		}

drivers/md/dm-table.c

+13 −2

Original line number	Diff line number	Diff line
		@@ -558,8 +558,19 @@ EXPORT_SYMBOL_GPL(dm_set_device_limits);
		*/
		void dm_put_device(struct dm_target ti, struct dm_dev d)
		{
		struct dm_dev_internal *dd = container_of(d, struct dm_dev_internal,
		dm_dev);
		struct dm_dev_internal *dd;

		if (!ti) {
		DMERR("%s: dm_target pointer is NULL", __func__);
		return;
		}

		if (!d) {
		DMERR("%s: dm_dev pointer is NULL", __func__);
		return;
		}

		dd = container_of(d, struct dm_dev_internal, dm_dev);

		if (atomic_dec_and_test(&dd->count)) {
		close_dev(dd, ti->table->md);