Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

ubifs: skip dumping tnc tree when zroot is null

Clearing slab cache will free all znode in memory and make
c->zroot.znode = NULL, then dumping tnc tree will access
c->zroot.znode which cause null pointer dereference.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=219624#c0
Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
Signed-off-by: pangliyuan <pangliyuan1@huawei.com>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

authored by

pangliyuan and committed by
Richard Weinberger
bdb0ca39 844c6fdc

+13 -9
+13 -9
fs/ubifs/debug.c
··· 945 945 946 946 pr_err("\n"); 947 947 pr_err("(pid %d) start dumping TNC tree\n", current->pid); 948 - znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL); 949 - level = znode->level; 950 - pr_err("== Level %d ==\n", level); 951 - while (znode) { 952 - if (level != znode->level) { 953 - level = znode->level; 954 - pr_err("== Level %d ==\n", level); 948 + if (c->zroot.znode) { 949 + znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL); 950 + level = znode->level; 951 + pr_err("== Level %d ==\n", level); 952 + while (znode) { 953 + if (level != znode->level) { 954 + level = znode->level; 955 + pr_err("== Level %d ==\n", level); 956 + } 957 + ubifs_dump_znode(c, znode); 958 + znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode); 955 959 } 956 - ubifs_dump_znode(c, znode); 957 - znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode); 960 + } else { 961 + pr_err("empty TNC tree in memory\n"); 958 962 } 959 963 pr_err("(pid %d) finish dumping TNC tree\n", current->pid); 960 964 }