[PATCH] fs: reiserfs: Fix possible null-pointer dereferences in remove_from_transaction()

[PATCH] fs: reiserfs: Fix possible null-pointer dereferences in remove_from_transaction()

[Jia-Ju Bai]

In remove_from_transaction(), there is an if statement on line 3447 to
check whether bh is NULL:
    if (bh)

When bh is NULL, it is used on line 3450:
    clear_buffer_journaled(bh);
and lines 3453-3456:
    clear_buffer_journal_dirty(bh);
    clear_buffer_dirty(bh);
    clear_buffer_journal_test(bh);
    put_bh(bh);

Thus, possible null-pointer dereferences may occur.

To fix these bugs, bh is checked before being used.

These bugs are found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
---
 fs/reiserfs/journal.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 4517a1394c6f..d115578597b6 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -3444,12 +3444,13 @@ static int remove_from_transaction(struct super_block *sb,
 	if (cn == journal->j_last) {
 		journal->j_last = cn->prev;
 	}
-	if (bh)
+	if (bh) {
 		remove_journal_hash(sb, journal->j_hash_table, NULL,
 				    bh->b_blocknr, 0);
-	clear_buffer_journaled(bh);	/* don't log this one */
+		clear_buffer_journaled(bh);	/* don't log this one */
+	}
 
-	if (!already_cleaned) {
+	if (!already_cleaned && bh) {
 		clear_buffer_journal_dirty(bh);
 		clear_buffer_dirty(bh);
 		clear_buffer_journal_test(bh);
-- 
2.17.0

Re: [PATCH] fs: reiserfs: Fix possible null-pointer dereferences in remove_from_transaction()

[Andrew Morton]

On Fri, 26 Jul 2019 16:38:38 +0800 Jia-Ju Bai <baijiaju1990@gmail.com> wrote:

> In remove_from_transaction(), there is an if statement on line 3447 to
> check whether bh is NULL:
>     if (bh)

We already know that bh != NULL here.

	cn = get_journal_hash_dev(sb, journal->j_hash_table, blocknr);
	if (!cn || !cn->bh) {
		return ret;
	}
	bh = cn->bh;


Please prepare a patch to remove the unneeded test?