LU-4629 osd-ldiskfs: Fix null pointer dereference

Null pointer 'ooc' that comes from line 1036 may be dereferenced
at line 1083.

Pointer 'it' checked for NULL at line 1036 may be passed to function
and may be dereferenced there by passing argument 2 to function
'osd_scrub_wakeup' at line 1089. Also there is one similar error on
line 1089.

Signed-off-by: Dmitry Eremin <dmitry.eremin@intel.com>
Change-Id: Iaffa27e48063fbff8b09f390760c24a1da8dd6b3
Reviewed-on: http://review.whamcloud.com/10610
Tested-by: Jenkins
Tested-by: Maloo <hpdd-maloo@intel.com>
Reviewed-by: Andreas Dilger <andreas.dilger@intel.com>
Reviewed-by: John L. Hammond <john.hammond@intel.com>
Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>

diff --git a/lustre/osd-ldiskfs/osd_scrub.c b/lustre/osd-ldiskfs/osd_scrub.c
index 7287a8b..d8a5cc5 100644 (file)
--- a/lustre/osd-ldiskfs/osd_scrub.c
+++ b/lustre/osd-ldiskfs/osd_scrub.c
@@ -1080,16 +1080,16 @@ wait:
        if (scrub->os_full_speed || rc == SCRUB_NEXT_CONTINUE)
                return 0;
 
-       if (osd_scrub_has_window(scrub, ooc)) {
+       if (ooc != NULL && osd_scrub_has_window(scrub, ooc)) {
                *noslot = 0;
                return 0;
        }
 
-       l_wait_event(thread->t_ctl_waitq,
-                    osd_scrub_wakeup(scrub, it),
-                    &lwi);
+       if (it != NULL)
+               l_wait_event(thread->t_ctl_waitq, osd_scrub_wakeup(scrub, it),
+                            &lwi);
 
-       if (osd_scrub_has_window(scrub, ooc))
+       if (ooc != NULL && osd_scrub_has_window(scrub, ooc))
                *noslot = 0;
        else
                *noslot = 1;