Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 491e94f7 authored by Bob Peterson's avatar Bob Peterson
Browse files

gfs2: Add missing else in trans_add_meta/data 



This patch fixes a timing window that causes a segfault.
The problem is that bd can remain NULL throughout the function
and then reference that NULL pointer if the bh->b_private starts
out NULL, then someone sets it to non-NULL inside the locking.
In that case, bd still needs to be set.

Signed-off-by: default avatarBob Peterson <rpeterso@redhat.com>
parent 6de20eb0

fs/gfs2/trans.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -176,6 +176,8 @@ void gfs2_trans_add_data(struct gfs2_glock *gl, struct buffer_head *bh) 
		unlock_buffer(bh);

		unlock_buffer(bh);

		if (bh->b_private == NULL)

		if (bh->b_private == NULL)

			bd = gfs2_alloc_bufdata(gl, bh, &gfs2_databuf_lops);

			bd = gfs2_alloc_bufdata(gl, bh, &gfs2_databuf_lops);

		else

			bd = bh->b_private;

		lock_buffer(bh);

		lock_buffer(bh);

		gfs2_log_lock(sdp);

		gfs2_log_lock(sdp);

	}

	}
@@ -236,6 +238,8 @@ void gfs2_trans_add_meta(struct gfs2_glock *gl, struct buffer_head *bh) 
		lock_page(bh->b_page);

		lock_page(bh->b_page);

		if (bh->b_private == NULL)

		if (bh->b_private == NULL)

			bd = gfs2_alloc_bufdata(gl, bh, &gfs2_buf_lops);

			bd = gfs2_alloc_bufdata(gl, bh, &gfs2_buf_lops);

		else

			bd = bh->b_private;

		unlock_page(bh->b_page);

		unlock_page(bh->b_page);

		lock_buffer(bh);

		lock_buffer(bh);

		gfs2_log_lock(sdp);

		gfs2_log_lock(sdp);