summaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorRoss Zwisler <ross.zwisler@linux.intel.com>2016-01-22 15:10:31 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2016-01-22 17:02:18 -0800
commitd4bbe7068b60e9263f08c54e6c2a0166c0f37317 (patch)
tree2b9f1223bd9742ccffde05d2dfc515231a5afdf5 /fs
parent2101ae42899a14fe7caa73114e2161e778328661 (diff)
downloadlinux-d4bbe7068b60e9263f08c54e6c2a0166c0f37317.tar.gz
linux-d4bbe7068b60e9263f08c54e6c2a0166c0f37317.tar.bz2
linux-d4bbe7068b60e9263f08c54e6c2a0166c0f37317.zip
dax: fix NULL pointer dereference in __dax_dbg()
In __dax_pmd_fault() we currently assume that get_block() will always set bh.b_bdev and we unconditionally dereference it in __dax_dbg(). This assumption isn't always true - when called for reads of holes ext4_dax_mmap_get_block() returns a buffer head where bh->b_bdev is never set. I hit this BUG while testing the DAX PMD fault path. Instead, initialize bh.b_bdev before passing bh into get_block(). It is possible that the filesystem's get_block() will update bh.b_bdev, and this is fine - we just want to initialize bh.b_bdev to something reasonable so that the calls to __dax_dbg() work and print something useful. Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com> Reported-by: Dan Williams <dan.j.williams@intel.com> Cc: Jan Kara <jack@suse.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/dax.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/dax.c b/fs/dax.c
index 7af879759064..513bba5f1e02 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -624,6 +624,7 @@ int __dax_pmd_fault(struct vm_area_struct *vma, unsigned long address,
}
memset(&bh, 0, sizeof(bh));
+ bh.b_bdev = inode->i_sb->s_bdev;
block = (sector_t)pgoff << (PAGE_SHIFT - blkbits);
bh.b_size = PMD_SIZE;