diff mbox series

[5.10,090/171] jfs: prevent NULL deref in diFree

Message ID	20220412062930.490026471@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, TCS Robot <tcs_robot@tencent.com>, Haimin Zhang <tcs_kernel@tencent.com>, Dave Kleikamp <dave.kleikamp@oracle.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 090/171] jfs: prevent NULL deref in diFree Date: Tue, 12 Apr 2022 08:29:41 +0200 Message-Id: <20220412062930.490026471@linuxfoundation.org> In-Reply-To: <20220412062927.870347203@linuxfoundation.org> References: <20220412062927.870347203@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/171] gfs2: Check for active reservation in gfs2_release [5.10,003/171] gfs2: Fix gfs2_release for non-writers regression [5.10,004/171] gfs2: gfs2_setattr_size error path fix [5.10,005/171] rtc: wm8350: Handle error for wm8350_register_irq [5.10,006/171] KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs [5.10,010/171] drm/amd/display: Add signal type check when verify stream backends same [5.10,011/171] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj [5.10,014/171] ptp: replace snprintf with sysfs_emit [5.10,015/171] powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 [5.10,018/171] bpf: Make dst_port field in struct bpf_sock 16-bit wide [5.10,020/171] scsi: bfa: Replace snprintf() with sysfs_emit() [5.10,023/171] cfg80211: dont add non transmitted BSS to 6GHz scanned channels [5.10,025/171] ipv6: make mc_forwarding atomic [5.10,027/171] drm/amdgpu: Fix recursive locking warning [5.10,031/171] PCI: endpoint: Fix alignment fault error in copy tests [5.10,033/171] PCI: pciehp: Add Qualcomm quirk for Command Completed erratum [5.10,034/171] power: supply: axp288-charger: Set Vhold to 4.4V [5.10,036/171] ipv4: Invalidate neighbour for broadcast address upon address addition [5.10,039/171] drm/amdkfd: make CRAT table missing message informational only [5.10,041/171] scsi: pm8001: Fix pm8001_mpi_task_abort_resp() [5.10,042/171] scsi: pm8001: Fix task leak in pm8001_send_abort_all() [5.10,044/171] scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() [5.10,046/171] scsi: aha152x: Fix aha152x_setup() __setup handler return value [5.10,047/171] scsi: hisi_sas: Free irq vectors in order for v3 HW [5.10,049/171] mips: ralink: fix a refcount leak in ill_acc_of_setup() [5.10,051/171] tuntap: add sanity checks about msg_controllen in sendmsg [5.10,053/171] Bluetooth: use memset avoid memory leaks [5.10,055/171] PCI: endpoint: Fix misused goto label [5.10,056/171] MIPS: fix fortify panic when copying asm exception handlers [5.10,059/171] scsi: libfc: Fix use after free in fc_exch_abts_resp() [5.10,060/171] can: isotp: set default value for N_As to 50 micro seconds [5.10,063/171] net: sfp: add 2500base-X quirk for Lantech SFP module [5.10,066/171] MIPS: ingenic: correct unit node address [5.10,067/171] Bluetooth: Fix use after free in hci_send_acl [5.10,070/171] init/main.c: return 1 from handled __setup() functions [5.10,073/171] staging: vchiq_core: handle NULL result of find_service_by_handle [5.10,076/171] w1: w1_therm: fixes w1_seq for ds28ea00 sensors [5.10,078/171] NFSv4: Protect the state recovery thread against direct reclaim [5.10,083/171] SUNRPC/xprt: async tasks mustnt block waiting for memory [5.10,085/171] NFS: swap IO handling is slightly different for O_DIRECT IO [5.10,087/171] x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy [5.10,088/171] serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() [5.10,089/171] virtio_console: eliminate anonymous module_init & module_exit [5.10,090/171] jfs: prevent NULL deref in diFree [5.10,093/171] NFS: Avoid writeback threads getting stuck in mempool_alloc() [5.10,095/171] parisc: Fix patch code locking and flushing [5.10,096/171] mm: fix race between MADV_FREE reclaim and blkdev direct IO read [5.10,100/171] Revert "NFSv4: Handle the special Linux file open access mode" [5.10,102/171] scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() [5.10,104/171] ice: Clear default forwarding VSI during VSI release [5.10,106/171] net: stmmac: Fix unset max_speed difference between DT and non-DT platforms [5.10,108/171] drm/imx: Fix memory leak in imx_pd_connector_get_modes [5.10,109/171] bnxt_en: reserve space inside receive page for skb_shared_info [5.10,111/171] RDMA/mlx5: Dont remove cache MRs when a delay is needed [5.10,113/171] dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe [5.10,114/171] ice: Set txq_teid to ICE_INVAL_TEID on ring creation [5.10,116/171] ipv6: Fix stats accounting in ip6_pkt_drop [5.10,119/171] net: openvswitch: fix leak of nested actions [5.10,121/171] net: phy: mscc-miim: reject clause 45 register accesses [5.10,125/171] drbd: Fix five use after free bugs in get_initial_state [5.10,126/171] io_uring: dont touch scm_fp_list after queueing skb [5.10,129/171] SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() [5.10,130/171] iommu/omap: Fix regression in probe for NULL pointer dereference [5.10,131/171] perf: arm-spe: Fix perf report --mem-mode [5.10,132/171] perf tools: Fix perfs libperf_print callback [5.10,135/171] Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" [5.10,137/171] mmc: renesas_sdhi: dont overwrite TAP settings when HS400 tuning is complete [5.10,139/171] mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) [5.10,140/171] mm/mempolicy: fix mpol_new leak in shared_policy_replace [5.10,143/171] x86/speculation: Restore speculation related MSRs during S3 resume [5.10,145/171] btrfs: prevent subvol with swapfile from being deleted [5.10,148/171] gpio: Restrict usage of GPIO chip irq members before initialization [5.10,150/171] perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator [5.10,152/171] drm/amdgpu/smu10: fix SoC/fclk units in auto mode [5.10,153/171] drm/nouveau/pmu: Add missing callbacks for Tegra devices [5.10,155/171] perf build: Dont use -ffat-lto-objects in the python feature test when building wi... [5.10,156/171] perf python: Fix probing for some clang command line options [5.10,158/171] tools build: Use $(shell ) instead of `` to get embedded libperls ccopts [5.10,159/171] dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" [5.10,161/171] mm: dont skip swap entry even if zap_details specified [5.10,164/171] selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644 [5.10,166/171] selftests: cgroup: Test open-time cgroup namespace usage for migration checks [5.10,170/171] mm/sparsemem: fix mem_section will never be NULL gcc 12 warning [5.10,171/171] powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit

Commit Message

Greg Kroah-Hartman April 12, 2022, 6:29 a.m. UTC

From: Haimin Zhang <tcs_kernel@tencent.com>

[ Upstream commit a53046291020ec41e09181396c1e829287b48d47 ]

Add validation check for JFS_IP(ipimap)->i_imap to prevent a NULL deref
in diFree since diFree uses it without do any validations.
When function jfs_mount calls diMount to initialize fileset inode
allocation map, it can fail and JFS_IP(ipimap)->i_imap won't be
initialized. Then it calls diFreeSpecial to close fileset inode allocation
map inode and it will flow into jfs_evict_inode. Function jfs_evict_inode
just validates JFS_SBI(inode->i_sb)->ipimap, then calls diFree. diFree use
JFS_IP(ipimap)->i_imap directly, then it will cause a NULL deref.

Reported-by: TCS Robot <tcs_robot@tencent.com>
Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/inode.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index b0eb9c85eea0..980aa3300f10 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -146,12 +146,13 @@  void jfs_evict_inode(struct inode *inode)
 		dquot_initialize(inode);
 
 		if (JFS_IP(inode)->fileset == FILESYSTEM_I) {
+			struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap;
 			truncate_inode_pages_final(&inode->i_data);
 
 			if (test_cflag(COMMIT_Freewmap, inode))
 				jfs_free_zero_link(inode);
 
-			if (JFS_SBI(inode->i_sb)->ipimap)
+			if (ipimap && JFS_IP(ipimap)->i_imap)
 				diFree(inode);
 
 			/*