diff options
| author | Dan Robertson <dan@dlrobertson.com> | 2021-05-12 20:54:37 -0400 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@gmail.com> | 2022-03-12 20:12:48 -0500 |
| commit | f2520d25b501c7c896c3345b798590f6c5205068 (patch) | |
| tree | d78702d4b91ce3378319818bc6debd0d97360e75 | |
| parent | 48229fb564404165ef7800f8b5910ebce43f01d7 (diff) | |
bcachefs: Fix null deref in bch2_ioctl_read_super
Do not attempt to cleanup the returned value of bch2_device_lookup if
the returned value was an error pointer. We currently check to see if
the returned value is null and run the cleanup otherwise. As a result,
we attempt to run the cleanup on a error pointer.
Signed-off-by: Dan Robertson <dan@dlrobertson.com>
| -rw-r--r-- | fs/bcachefs/chardev.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/bcachefs/chardev.c b/fs/bcachefs/chardev.c index c61601476c0d..ba8873ccde6c 100644 --- a/fs/bcachefs/chardev.c +++ b/fs/bcachefs/chardev.c @@ -523,7 +523,7 @@ static long bch2_ioctl_read_super(struct bch_fs *c, ret = copy_to_user((void __user *)(unsigned long)arg.sb, sb, vstruct_bytes(sb)); err: - if (ca) + if (!IS_ERR_OR_NULL(ca)) percpu_ref_put(&ca->ref); mutex_unlock(&c->sb_lock); return ret; |