diff options
| author |   Chao Yu <yuchao0@huawei.com> | 2020-02-24 19:20:17 +0800 |
|---|---|---|
| committer |   Jaegeuk Kim <jaegeuk@kernel.org> | 2020-02-27 10:16:45 -0800 |
| commit | 61fbae2b2b1201525f8f0f35e0bdf6dfa8ec8541 (patch) | |
| tree | bd424464621dfcd8161f2a5311ead8516f12e37f /fs/f2fs/compress.c | |
| parent | f2fs: fix leaking uninitialized memory in compressed clusters (diff) | |
| download | wireguard-linux-61fbae2b2b1201525f8f0f35e0bdf6dfa8ec8541.tar.xz wireguard-linux-61fbae2b2b1201525f8f0f35e0bdf6dfa8ec8541.zip | |
f2fs: fix to avoid NULL pointer dereference
Unable to handle kernel NULL pointer dereference at virtual address 00000000
PC is at f2fs_free_dic+0x60/0x2c8
LR is at f2fs_decompress_pages+0x3c4/0x3e8
f2fs_free_dic+0x60/0x2c8
f2fs_decompress_pages+0x3c4/0x3e8
__read_end_io+0x78/0x19c
f2fs_post_read_work+0x6c/0x94
process_one_work+0x210/0x48c
worker_thread+0x2e8/0x44c
kthread+0x110/0x120
ret_from_fork+0x10/0x18
In f2fs_free_dic(), we can not use f2fs_put_page(,1) to release dic->tpages[i],
as the page's mapping is NULL.
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Diffstat (limited to 'fs/f2fs/compress.c')
| -rw-r--r-- | fs/f2fs/compress.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c index ef7dd04312fe..dde8ca08e94d 100644 --- a/fs/f2fs/compress.c +++ b/fs/f2fs/compress.c @@ -1137,7 +1137,8 @@ void f2fs_free_dic(struct decompress_io_ctx *dic) for (i = 0; i < dic->cluster_size; i++) { if (dic->rpages[i]) continue; - f2fs_put_page(dic->tpages[i], 1); + unlock_page(dic->tpages[i]); + put_page(dic->tpages[i]); } kfree(dic->tpages); } |