From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C956C7EE23 for ; Sun, 4 Jun 2023 11:16:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231140AbjFDLQg (ORCPT ); Sun, 4 Jun 2023 07:16:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60224 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229462AbjFDLQf (ORCPT ); Sun, 4 Jun 2023 07:16:35 -0400 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1AD9CD3; Sun, 4 Jun 2023 04:16:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=wV+lTMaC3z644k/Yk/InRSq/6/07bZzUxmzLJgoLbjo=; b=Dsdlr2BLmVqV3RBisOg/nK3OdP tOCh/wYU5HDWFk4JuckrcEaYNaH9ZMYgs3fBBh+3Ueuhz48NuCyDuFI7NfWrid4XL/85iwvzacwN9 VjTjfiFWVHV9XQZwfhhfGzw+Orq83LawvtclvKFsi0dmqfaAoGIQAg/rYsp3LMB3VBu/J5JLhq7lg vxCTkzMq3QuD6IqMBt46tN+Pj0t7mU2az3i3yOJHckmSgGmCsPiUOCYu5ihoSyrCivmfZkAkNYTIO 2iWuhVl2TdMbtsLaBOXVDhDhBf/54wGDw3khF8u0augaBLOgtGMt7pIhL3S4aUDUHRQvlmPz5hUyF 0jpZIDyA==; Received: from willy by casper.infradead.org with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1q5liQ-00AzJH-Ij; Sun, 04 Jun 2023 11:16:06 +0000 Date: Sun, 4 Jun 2023 12:16:06 +0100 From: Matthew Wilcox To: butt3rflyh4ck Cc: Jan Kara , akpm@linux-foundation.org, yi.zhang@huawei.com, trix@redhat.com, song@kernel.org, bvanassche@acm.org, reiserfs-devel@vger.kernel.org, LKML Subject: Re: A null-ptr-deref bug in reiserfs_breada in fs/reiserfs/journal.c Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Jun 04, 2023 at 04:12:56PM +0800, butt3rflyh4ck wrote: > Hi, there is a null-ptr-deref bug in reiserfs_breada in > fs/reiserfs/journal.c, I reproduce it in the latest kernel too. does this fix the problem? diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c index 4d11d60f493c..dd58e0dca5e5 100644 --- a/fs/reiserfs/journal.c +++ b/fs/reiserfs/journal.c @@ -2326,7 +2326,7 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev, int i, j; bh = __getblk(dev, block, bufsize); - if (buffer_uptodate(bh)) + if (!bh || buffer_uptodate(bh)) return (bh); if (block + BUFNR > max_block) { @@ -2336,6 +2336,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev, j = 1; for (i = 1; i < blocks; i++) { bh = __getblk(dev, block + i, bufsize); + if (!bh) + break; if (buffer_uptodate(bh)) { brelse(bh); break;