Skip to content

Commit c354557

Browse files
jdurginSage Weil
authored and
Sage Weil
committed
rbd: fix null dereference in dout
The order parameter is sometimes NULL in _rbd_dev_v2_snap_size(), but the dout() always derefences it. Move this to another dout() protected by a check that order is non-NULL. Signed-off-by: Josh Durgin <[email protected]> Reviewed-by: Sage Weil <[email protected]> Reviewed-by: Alex Elder <[email protected]>
1 parent 03507db commit c354557

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

drivers/block/rbd.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3702,12 +3702,14 @@ static int _rbd_dev_v2_snap_size(struct rbd_device *rbd_dev, u64 snap_id,
37023702
if (ret < sizeof (size_buf))
37033703
return -ERANGE;
37043704

3705-
if (order)
3705+
if (order) {
37063706
*order = size_buf.order;
3707+
dout(" order %u", (unsigned int)*order);
3708+
}
37073709
*snap_size = le64_to_cpu(size_buf.size);
37083710

3709-
dout(" snap_id 0x%016llx order = %u, snap_size = %llu\n",
3710-
(unsigned long long)snap_id, (unsigned int)*order,
3711+
dout(" snap_id 0x%016llx snap_size = %llu\n",
3712+
(unsigned long long)snap_id,
37113713
(unsigned long long)*snap_size);
37123714

37133715
return 0;

0 commit comments

Comments
 (0)