Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=49ee6c911f0ae5b3a9a04e0589e3265e52f94f53
Commit:     49ee6c911f0ae5b3a9a04e0589e3265e52f94f53
Parent:     dcb3b83febd1028afbc4a32cf7642a6580e349c6
Author:     Jesper Juhl <[EMAIL PROTECTED]>
AuthorDate: Thu Aug 16 16:25:42 2007 +1000
Committer:  Tim Shimmin <[EMAIL PROTECTED]>
CommitDate: Mon Oct 15 16:42:48 2007 +1000

    [XFS] Fix a potential NULL pointer deref in XFS on failed mount.
    
    If we fail to open the the log device buftarg, we can fall through to
    error handling code that fails to check for a NULL log device buftarg
    before calling xfs_free_buftarg().
    
    This patch fixes the issue by checking mp->m_logdev_targp against NULL in
    xfs_unmountfs_close() and doing the proper xfs_blkdev_put(logdev); and
    xfs_blkdev_put(rtdev); on (!mp->m_rtdev_targp) in xfs_mount().
    
    Discovered by the Coverity checker.
    
    SGI-PV: 968563
    SGI-Modid: xfs-linux-melb:xfs-kern:29328a
    
    Signed-off-by: Jesper Juhl <[EMAIL PROTECTED]>
    Signed-off-by: David Chinner <[EMAIL PROTECTED]>
    Signed-off-by: Tim Shimmin <[EMAIL PROTECTED]>
---
 fs/xfs/xfs_mount.c  |    2 +-
 fs/xfs/xfs_vfsops.c |   10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index cfe4de5..eef27f2 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1262,7 +1262,7 @@ xfs_unmountfs(xfs_mount_t *mp, struct cred *cr)
 void
 xfs_unmountfs_close(xfs_mount_t *mp, struct cred *cr)
 {
-       if (mp->m_logdev_targp != mp->m_ddev_targp)
+       if (mp->m_logdev_targp && mp->m_logdev_targp != mp->m_ddev_targp)
                xfs_free_buftarg(mp->m_logdev_targp, 1);
        if (mp->m_rtdev_targp)
                xfs_free_buftarg(mp->m_rtdev_targp, 1);
diff --git a/fs/xfs/xfs_vfsops.c b/fs/xfs/xfs_vfsops.c
index 47c8907..ba8f7a3 100644
--- a/fs/xfs/xfs_vfsops.c
+++ b/fs/xfs/xfs_vfsops.c
@@ -480,13 +480,19 @@ xfs_mount(
        }
        if (rtdev) {
                mp->m_rtdev_targp = xfs_alloc_buftarg(rtdev, 1);
-               if (!mp->m_rtdev_targp)
+               if (!mp->m_rtdev_targp) {
+                       xfs_blkdev_put(logdev);
+                       xfs_blkdev_put(rtdev);
                        goto error0;
+               }
        }
        mp->m_logdev_targp = (logdev && logdev != ddev) ?
                                xfs_alloc_buftarg(logdev, 1) : mp->m_ddev_targp;
-       if (!mp->m_logdev_targp)
+       if (!mp->m_logdev_targp) {
+               xfs_blkdev_put(logdev);
+               xfs_blkdev_put(rtdev);
                goto error0;
+       }
 
        /*
         * Setup flags based on mount(2) options and then the superblock
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to