From 1f0d8a566f0251ff9404b98233ae8d5406c6d308 Mon Sep 17 00:00:00 2001 From: Gunnar Beutner Date: Thu, 5 Apr 2012 10:30:10 +0200 Subject: [PATCH] Fixed a NULL pointer dereference bug in zfs_preumount When zpl_fill_super -> zfs_domount fails (e.g. because the dataset was destroyed before it could be successfully mounted) the subsequent call to zpl_kill_sb -> zfs_preumount would derefence a NULL pointer. This bug can be reproduced using this shell script: #!/bin/sh ( while true; do zfs create -o mountpoint=legacz tank/bar zfs destroy tank/bar done ) & ( while true; do mount -t zfs tank/bar /mnt umount /mnt done ) & Signed-off-by: Brian Behlendorf Closes #639 --- module/zfs/zfs_vfsops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module/zfs/zfs_vfsops.c b/module/zfs/zfs_vfsops.c index 8f1c713c0..998cfde32 100644 --- a/module/zfs/zfs_vfsops.c +++ b/module/zfs/zfs_vfsops.c @@ -1231,7 +1231,7 @@ zfs_preumount(struct super_block *sb) { zfs_sb_t *zsb = sb->s_fs_info; - if (zsb->z_ctldir != NULL) + if (zsb != NULL && zsb->z_ctldir != NULL) zfsctl_destroy(zsb); } EXPORT_SYMBOL(zfs_preumount);