[XFS] Fix a potential NULL pointer deref in XFS on failed mount.
authorJesper Juhl <jesper.juhl@gmail.com>
Thu, 16 Aug 2007 06:25:42 +0000 (16:25 +1000)
committerTim Shimmin <tes@chook.melbourne.sgi.com>
Mon, 15 Oct 2007 06:42:48 +0000 (16:42 +1000)
If we fail to open the the log device buftarg, we can fall through to
error handling code that fails to check for a NULL log device buftarg
before calling xfs_free_buftarg().

This patch fixes the issue by checking mp->m_logdev_targp against NULL in
xfs_unmountfs_close() and doing the proper xfs_blkdev_put(logdev); and
xfs_blkdev_put(rtdev); on (!mp->m_rtdev_targp) in xfs_mount().

Discovered by the Coverity checker.

SGI-PV: 968563
SGI-Modid: xfs-linux-melb:xfs-kern:29328a

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: David Chinner <dgc@sgi.com>
Signed-off-by: Tim Shimmin <tes@sgi.com>
fs/xfs/xfs_mount.c
fs/xfs/xfs_vfsops.c

index cfe4de5def897de9fdb314183820c8d3c444373b..eef27f21f9ab36a727b21e0832aa3d76e123d5dd 100644 (file)
@@ -1262,7 +1262,7 @@ xfs_unmountfs(xfs_mount_t *mp, struct cred *cr)
 void
 xfs_unmountfs_close(xfs_mount_t *mp, struct cred *cr)
 {
-       if (mp->m_logdev_targp != mp->m_ddev_targp)
+       if (mp->m_logdev_targp && mp->m_logdev_targp != mp->m_ddev_targp)
                xfs_free_buftarg(mp->m_logdev_targp, 1);
        if (mp->m_rtdev_targp)
                xfs_free_buftarg(mp->m_rtdev_targp, 1);
index 47c890778bb6d1ddb52e243068b7ff248b72390c..ba8f7a3e40281709690456c6a756b9ee2dc7c8db 100644 (file)
@@ -480,13 +480,19 @@ xfs_mount(
        }
        if (rtdev) {
                mp->m_rtdev_targp = xfs_alloc_buftarg(rtdev, 1);
-               if (!mp->m_rtdev_targp)
+               if (!mp->m_rtdev_targp) {
+                       xfs_blkdev_put(logdev);
+                       xfs_blkdev_put(rtdev);
                        goto error0;
+               }
        }
        mp->m_logdev_targp = (logdev && logdev != ddev) ?
                                xfs_alloc_buftarg(logdev, 1) : mp->m_ddev_targp;
-       if (!mp->m_logdev_targp)
+       if (!mp->m_logdev_targp) {
+               xfs_blkdev_put(logdev);
+               xfs_blkdev_put(rtdev);
                goto error0;
+       }
 
        /*
         * Setup flags based on mount(2) options and then the superblock