[XFS] Fix a potential NULL pointer deref in XFS on failed mount. (49ee6c91) · Commits · 戴 / test

If we fail to open the the log device buftarg, we can fall through to error handling code that fails to check for a NULL log device buftarg before calling xfs_free_buftarg(). This patch fixes the issue by checking mp->m_logdev_targp against NULL in xfs_unmountfs_close() and doing the proper xfs_blkdev_put(logdev); and xfs_blkdev_put(rtdev); on (!mp->m_rtdev_targp) in xfs_mount(). Discovered by the Coverity checker. SGI-PV: 968563 SGI-Modid: xfs-linux-melb:xfs-kern:29328a Signed-off-by:

Jesper Juhl <jesper.juhl@gmail.com> Signed-off-by:

David Chinner <dgc@sgi.com> Signed-off-by:

Tim Shimmin <tes@sgi.com>

fs/xfs/xfs_mount.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1262,7 +1262,7 @@ xfs_unmountfs(xfs_mount_t mp, struct cred cr)
		void
		xfs_unmountfs_close(xfs_mount_t mp, struct cred cr)
		{
		if (mp->m_logdev_targp != mp->m_ddev_targp)
		if (mp->m_logdev_targp && mp->m_logdev_targp != mp->m_ddev_targp)
		xfs_free_buftarg(mp->m_logdev_targp, 1);
		if (mp->m_rtdev_targp)
		xfs_free_buftarg(mp->m_rtdev_targp, 1);

fs/xfs/xfs_vfsops.c

+8 −2

Original line number	Diff line number	Diff line
		@@ -480,13 +480,19 @@ xfs_mount(
		}
		if (rtdev) {
		mp->m_rtdev_targp = xfs_alloc_buftarg(rtdev, 1);
		if (!mp->m_rtdev_targp)
		if (!mp->m_rtdev_targp) {
		xfs_blkdev_put(logdev);
		xfs_blkdev_put(rtdev);
		goto error0;
		}
		}
		mp->m_logdev_targp = (logdev && logdev != ddev) ?
		xfs_alloc_buftarg(logdev, 1) : mp->m_ddev_targp;
		if (!mp->m_logdev_targp)
		if (!mp->m_logdev_targp) {
		xfs_blkdev_put(logdev);
		xfs_blkdev_put(rtdev);
		goto error0;
		}

		/*
		* Setup flags based on mount(2) options and then the superblock

Admin message