Skip to content

Commit c3d6569

Browse files
committed
cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode
cachefiles_ondemand_init_object() as called from cachefiles_open_file() and cachefiles_create_tmpfile() does not check if object->ondemand is set before dereferencing it, leading to an oops something like: RIP: 0010:cachefiles_ondemand_init_object+0x9/0x41 ... Call Trace: <TASK> cachefiles_open_file+0xc9/0x187 cachefiles_lookup_cookie+0x122/0x2be fscache_cookie_state_machine+0xbe/0x32b fscache_cookie_worker+0x1f/0x2d process_one_work+0x136/0x208 process_scheduled_works+0x3a/0x41 worker_thread+0x1a2/0x1f6 kthread+0xca/0xd2 ret_from_fork+0x21/0x33 Fix this by making cachefiles_ondemand_init_object() return immediately if cachefiles->ondemand is NULL. Fixes: 3c5ecfe ("cachefiles: extract ondemand info field from cachefiles_object") Reported-by: Marc Dionne <[email protected]> Signed-off-by: David Howells <[email protected]> cc: Gao Xiang <[email protected]> cc: Chao Yu <[email protected]> cc: Yue Hu <[email protected]> cc: Jeffle Xu <[email protected]> cc: [email protected] cc: [email protected] cc: [email protected]
1 parent 843609d commit c3d6569

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

fs/cachefiles/ondemand.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -539,6 +539,9 @@ int cachefiles_ondemand_init_object(struct cachefiles_object *object)
539539
struct fscache_volume *volume = object->volume->vcookie;
540540
size_t volume_key_size, cookie_key_size, data_len;
541541

542+
if (!object->ondemand)
543+
return 0;
544+
542545
/*
543546
* CacheFiles will firstly check the cache file under the root cache
544547
* directory. If the coherency check failed, it will fallback to

0 commit comments

Comments
 (0)