mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
btrfs: fix null pointer dereference in clone_fs_devices when name is null
when one of the device path is missing btrfs_device name is null. So this patch will check for that. stack: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [<ffffffff812e18c0>] strlen+0x0/0x30 [<ffffffffa01cd92a>] ? clone_fs_devices+0xaa/0x160 [btrfs] [<ffffffffa01cdcf7>] btrfs_init_new_device+0x317/0xca0 [btrfs] [<ffffffff81155bca>] ? __kmalloc_track_caller+0x15a/0x1a0 [<ffffffffa01d6473>] btrfs_ioctl+0xaa3/0x2860 [btrfs] [<ffffffff81132a6c>] ? handle_mm_fault+0x48c/0x9c0 [<ffffffff81192a61>] ? __blkdev_put+0x171/0x180 [<ffffffff817a784c>] ? __do_page_fault+0x4ac/0x590 [<ffffffff81193426>] ? blkdev_put+0x106/0x110 [<ffffffff81179175>] ? mntput+0x35/0x40 [<ffffffff8116d4b0>] do_vfs_ioctl+0x460/0x4a0 [<ffffffff8115c72e>] ? ____fput+0xe/0x10 [<ffffffff81068033>] ? task_work_run+0xb3/0xd0 [<ffffffff8116d547>] SyS_ioctl+0x57/0x90 [<ffffffff817a793e>] ? do_page_fault+0xe/0x10 [<ffffffff817abe52>] system_call_fastpath+0x16/0x1b reproducer: mkfs.btrfs -draid1 -mraid1 /dev/sdg1 /dev/sdg2 btrfstune -S 1 /dev/sdg1 modprobe -r btrfs && modprobe btrfs mount -o degraded /dev/sdg1 /btrfs btrfs dev add /dev/sdg3 /btrfs Signed-off-by: Anand Jain <Anand.Jain@oracle.com> Signed-off-by: Chris Mason <clm@fb.com>
This commit is contained in:
parent
2aa06a35d0
commit
e755f78086
1 changed files with 7 additions and 5 deletions
|
@ -555,12 +555,14 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig)
|
||||||
* This is ok to do without rcu read locked because we hold the
|
* This is ok to do without rcu read locked because we hold the
|
||||||
* uuid mutex so nothing we touch in here is going to disappear.
|
* uuid mutex so nothing we touch in here is going to disappear.
|
||||||
*/
|
*/
|
||||||
name = rcu_string_strdup(orig_dev->name->str, GFP_NOFS);
|
if (orig_dev->name) {
|
||||||
if (!name) {
|
name = rcu_string_strdup(orig_dev->name->str, GFP_NOFS);
|
||||||
kfree(device);
|
if (!name) {
|
||||||
goto error;
|
kfree(device);
|
||||||
|
goto error;
|
||||||
|
}
|
||||||
|
rcu_assign_pointer(device->name, name);
|
||||||
}
|
}
|
||||||
rcu_assign_pointer(device->name, name);
|
|
||||||
|
|
||||||
list_add(&device->dev_list, &fs_devices->devices);
|
list_add(&device->dev_list, &fs_devices->devices);
|
||||||
device->fs_devices = fs_devices;
|
device->fs_devices = fs_devices;
|
||||||
|
|
Loading…
Reference in a new issue