]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
gfs2: Fix NULL pointer dereference in gfs2_rgrp_dump
authorAndrew Price <anprice@redhat.com>
Wed, 7 Oct 2020 11:30:58 +0000 (12:30 +0100)
committerAndreas Gruenbacher <agruenba@redhat.com>
Wed, 14 Oct 2020 21:54:43 +0000 (23:54 +0200)
commit0e539ca1bbbe85a86549c97a30a765ada4a09df9
tree939ab3e225c1051b9a3a23a2ffda1428739cf758
parent2164f9b9186962ffb7c687e18ec6f5255525f09d
gfs2: Fix NULL pointer dereference in gfs2_rgrp_dump

When an rindex entry is found to be corrupt, compute_bitstructs() calls
gfs2_consist_rgrpd() which calls gfs2_rgrp_dump() like this:

    gfs2_rgrp_dump(NULL, rgd->rd_gl, fs_id_buf);

gfs2_rgrp_dump then dereferences the gl without checking it and we get

    BUG: KASAN: null-ptr-deref in gfs2_rgrp_dump+0x28/0x280

because there's no rgrp glock involved while reading the rindex on mount.

Fix this by changing gfs2_rgrp_dump to take an rgrp argument.

Reported-by: syzbot+43fa87986bdd31df9de6@syzkaller.appspotmail.com
Signed-off-by: Andrew Price <anprice@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
fs/gfs2/glops.c
fs/gfs2/rgrp.c
fs/gfs2/rgrp.h
fs/gfs2/util.c