From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753191AbcBAHCe (ORCPT ); Mon, 1 Feb 2016 02:02:34 -0500 Received: from szxga01-in.huawei.com ([58.251.152.64]:51942 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751820AbcBAHCc (ORCPT ); Mon, 1 Feb 2016 02:02:32 -0500 From: DingXiang To: CC: , , , DingXiang Subject: [PATCH] [dm]fix NULL pointer in dm_exception_store_create() when create dm device Date: Mon, 1 Feb 2016 15:05:58 +0800 Message-ID: <1454310358-755-1-git-send-email-dingxiang@huawei.com> X-Mailer: git-send-email 1.7.1 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.175.100.166] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020206.56AF0303.006E,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 3b51bab166fb6f71f639bba863a8e9bb Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In some conditions(such as umount fs failed),origin path or origin bdev or both of the two is same as cow's.If this happens, origin dev will be freed when get cow dev in function "dm_get_device" , then "s->origin->dev" which used by "dm_exception_store_create" will be a NULL pointer. Signed-off-by:Ding Xiang --- drivers/md/dm-snap.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c index 3766386..ccf97d8 100644 --- a/drivers/md/dm-snap.c +++ b/drivers/md/dm-snap.c @@ -1102,6 +1102,7 @@ static void stop_merge(struct dm_snapshot *s) static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) { struct dm_snapshot *s; + struct block_device *origin_bdev, *cow_bdev; int i; int r = -EINVAL; char *origin_path, *cow_path; @@ -1136,10 +1137,19 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) goto bad_origin; } + origin_bdev = s->origin->bdev; cow_path = argv[0]; argv++; argc--; + /*check cow dev is available*/ + cow_bdev = lookup_bdev(cow_path); + if(cow_bdev->bd_dev == origin_bdev->bd_dev){ + ti->error = "Invalid COW device"; + r = -EINVAL; + goto bad_cow; + } + r = dm_get_device(ti, cow_path, dm_table_get_mode(ti->table), &s->cow); if (r) { ti->error = "Cannot get COW device"; -- 1.7.1