In btree_split, btree_node_alloc_replacement() is assigned to
n1 and return error code or NULL on failure. n1->c->cache is
passed to block_bytes. So there is a dereference of it
without checks, which may lead to wild pointer dereference or
NULL pointer dereference depending on n1. The initial code only
judge the error code but igore the NULL pointer.
So does n2 and n3.
Fix this bug by adding IS_ERR_OR_NULL check of n1, n2 and n3.
Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger.
Fixes: cafe56359144 ("bcache: A block layer cache")
Signed-off-by: Zheng Wang <zyytlz.wz@xxxxxxx>
---
drivers/md/bcache/btree.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 147c493a989a..d5ed382fc43c 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -2206,7 +2206,7 @@ static int btree_split(struct btree *b, struct btree_op *op,
}
n1 = btree_node_alloc_replacement(b, op);
- if (IS_ERR(n1))
+ if (IS_ERR_OR_NULL(n1))
goto err;
split = set_blocks(btree_bset_first(n1),
@@ -2218,12 +2218,12 @@ static int btree_split(struct btree *b, struct btree_op *op,
trace_bcache_btree_node_split(b, btree_bset_first(n1)->keys);
n2 = bch_btree_node_alloc(b->c, op, b->level, b->parent);
- if (IS_ERR(n2))
+ if (IS_ERR_OR_NULL(n2))
goto err_free1;
if (!b->parent) {
n3 = bch_btree_node_alloc(b->c, op, b->level + 1, NULL);
- if (IS_ERR(n3))
+ if (IS_ERR_OR_NULL(n3))
goto err_free2;
}
--
2.25.1
