浏览代码

freevxfs: possible null pointer dereference fix

sb_read may return NULL, so let's explicitly check it.

Signed-off-by: Dmitriy Monakhov <dmonakhov@openvz.org>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Dmitriy Monakhov 18 年之前
父节点
当前提交
82f703bb8c
共有 2 个文件被更改,包括 2 次插入2 次删除
  1. 1 1
      fs/freevxfs/vxfs_bmap.c
  2. 1 1
      fs/freevxfs/vxfs_inode.c

+ 1 - 1
fs/freevxfs/vxfs_bmap.c

@@ -137,7 +137,7 @@ vxfs_bmap_indir(struct inode *ip, long indir, int size, long block)
 
 
 		bp = sb_bread(ip->i_sb,
 		bp = sb_bread(ip->i_sb,
 				indir + (i / VXFS_TYPED_PER_BLOCK(ip->i_sb)));
 				indir + (i / VXFS_TYPED_PER_BLOCK(ip->i_sb)));
-		if (!buffer_mapped(bp))
+		if (!bp || !buffer_mapped(bp))
 			return 0;
 			return 0;
 
 
 		typ = ((struct vxfs_typed *)bp->b_data) +
 		typ = ((struct vxfs_typed *)bp->b_data) +

+ 1 - 1
fs/freevxfs/vxfs_inode.c

@@ -99,7 +99,7 @@ vxfs_blkiget(struct super_block *sbp, u_long extent, ino_t ino)
 	offset = ((ino % (sbp->s_blocksize / VXFS_ISIZE)) * VXFS_ISIZE);
 	offset = ((ino % (sbp->s_blocksize / VXFS_ISIZE)) * VXFS_ISIZE);
 	bp = sb_bread(sbp, block);
 	bp = sb_bread(sbp, block);
 
 
-	if (buffer_mapped(bp)) {
+	if (bp && buffer_mapped(bp)) {
 		struct vxfs_inode_info	*vip;
 		struct vxfs_inode_info	*vip;
 		struct vxfs_dinode	*dip;
 		struct vxfs_dinode	*dip;