[PATCH] fs: reiserfs: Fix possible null-pointer dereferences in remove_from_transaction()

[Jia-Ju Bai]

In remove_from_transaction(), there is an if statement on line 3447 to
check whether bh is NULL:
    if (bh)

When bh is NULL, it is used on line 3450:
    clear_buffer_journaled(bh);
and lines 3453-3456:
    clear_buffer_journal_dirty(bh);
    clear_buffer_dirty(bh);
    clear_buffer_journal_test(bh);
    put_bh(bh);

Thus, possible null-pointer dereferences may occur.

To fix these bugs, bh is checked before being used.

These bugs are found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1...@gmail.com>
---
 fs/reiserfs/journal.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 4517a1394c6f..d115578597b6 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -3444,12 +3444,13 @@ static int remove_from_transaction(struct super_block 
*sb,
        if (cn == journal->j_last) {
                journal->j_last = cn->prev;
        }
-       if (bh)
+       if (bh) {
                remove_journal_hash(sb, journal->j_hash_table, NULL,
                                    bh->b_blocknr, 0);
-       clear_buffer_journaled(bh);     /* don't log this one */
+               clear_buffer_journaled(bh);     /* don't log this one */
+       }
 
-       if (!already_cleaned) {
+       if (!already_cleaned && bh) {
                clear_buffer_journal_dirty(bh);
                clear_buffer_dirty(bh);
                clear_buffer_journal_test(bh);
-- 
2.17.0