Skip to content
Snippets Groups Projects
Commit 01334116 authored by Haimin Zhang's avatar Haimin Zhang Committed by Laibin Qiu
Browse files

jfs: prevent NULL deref in diFree

stable inclusion
from stable-v5.10.111
commit b9c5ac0a15f24d63b20f899072fa6dd8c93af136
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5RX0N?from=project-issue


CVE: CVE-2022-3202

--------------------------------

[ Upstream commit a53046291020ec41e09181396c1e829287b48d47 ]

Add validation check for JFS_IP(ipimap)->i_imap to prevent a NULL deref
in diFree since diFree uses it without do any validations.
When function jfs_mount calls diMount to initialize fileset inode
allocation map, it can fail and JFS_IP(ipimap)->i_imap won't be
initialized. Then it calls diFreeSpecial to close fileset inode allocation
map inode and it will flow into jfs_evict_inode. Function jfs_evict_inode
just validates JFS_SBI(inode->i_sb)->ipimap, then calls diFree. diFree use
JFS_IP(ipimap)->i_imap directly, then it will cause a NULL deref.

Reported-by: default avatarTCS Robot <tcs_robot@tencent.com>
Signed-off-by: default avatarHaimin Zhang <tcs_kernel@tencent.com>
Signed-off-by: Dave Kleikamp <da...
parent 6a2d6565
No related branches found
No related tags found
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment