a530462910
Add validation check for JFS_IP(ipimap)->i_imap to prevent a NULL deref in diFree since diFree uses it without do any validations. When function jfs_mount calls diMount to initialize fileset inode allocation map, it can fail and JFS_IP(ipimap)->i_imap won't be initialized. Then it calls diFreeSpecial to close fileset inode allocation map inode and it will flow into jfs_evict_inode. Function jfs_evict_inode just validates JFS_SBI(inode->i_sb)->ipimap, then calls diFree. diFree use JFS_IP(ipimap)->i_imap directly, then it will cause a NULL deref. Reported-by: TCS Robot <tcs_robot@tencent.com> Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> |
||
---|---|---|
.. | ||
acl.c | ||
file.c | ||
inode.c | ||
ioctl.c | ||
jfs_acl.h | ||
jfs_btree.h | ||
jfs_debug.c | ||
jfs_debug.h | ||
jfs_dinode.h | ||
jfs_discard.c | ||
jfs_discard.h | ||
jfs_dmap.c | ||
jfs_dmap.h | ||
jfs_dtree.c | ||
jfs_dtree.h | ||
jfs_extent.c | ||
jfs_extent.h | ||
jfs_filsys.h | ||
jfs_imap.c | ||
jfs_imap.h | ||
jfs_incore.h | ||
jfs_inode.c | ||
jfs_inode.h | ||
jfs_lock.h | ||
jfs_logmgr.c | ||
jfs_logmgr.h | ||
jfs_metapage.c | ||
jfs_metapage.h | ||
jfs_mount.c | ||
jfs_superblock.h | ||
jfs_txnmgr.c | ||
jfs_txnmgr.h | ||
jfs_types.h | ||
jfs_umount.c | ||
jfs_unicode.c | ||
jfs_unicode.h | ||
jfs_uniupr.c | ||
jfs_xattr.h | ||
jfs_xtree.c | ||
jfs_xtree.h | ||
Kconfig | ||
Makefile | ||
namei.c | ||
resize.c | ||
super.c | ||
symlink.c | ||
xattr.c |