From patchwork Sun May 13 14:41:04 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 158837 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6834AB7004 for ; Mon, 14 May 2012 00:41:19 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753212Ab2EMOlR (ORCPT ); Sun, 13 May 2012 10:41:17 -0400 Received: from acsinet15.oracle.com ([141.146.126.227]:51017 "EHLO acsinet15.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751901Ab2EMOlQ (ORCPT ); Sun, 13 May 2012 10:41:16 -0400 Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by acsinet15.oracle.com (Sentrion-MTA-4.2.2/Sentrion-MTA-4.2.2) with ESMTP id q4DEfBXA005215 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sun, 13 May 2012 14:41:12 GMT Received: from acsmt357.oracle.com (acsmt357.oracle.com [141.146.40.157]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id q4DEfBKa025544 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 13 May 2012 14:41:11 GMT Received: from abhmt101.oracle.com (abhmt101.oracle.com [141.146.116.53]) by acsmt357.oracle.com (8.12.11.20060308/8.12.11) with ESMTP id q4DEfA5O025583; Sun, 13 May 2012 09:41:10 -0500 Received: from elgon.mountain (/41.139.221.94) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sun, 13 May 2012 07:41:09 -0700 Date: Sun, 13 May 2012 17:41:04 +0300 From: Dan Carpenter To: "Theodore Ts'o" Cc: Andreas Dilger , linux-ext4@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] ext4: potential NULL dereference on error Message-ID: <20120513144104.GA21998@elgon.mountain> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org The ext4_get_group_desc() function returns NULL on error, and ext4_free_inodes_count() function dereferences it without checking. There is a check on the next line, but it's too late. Signed-off-by: Dan Carpenter --- Static checker fix. -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c index a044a9b..1526f33 100644 --- a/fs/ext4/ialloc.c +++ b/fs/ext4/ialloc.c @@ -389,7 +389,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent, struct ext4_sb_info *sbi = EXT4_SB(sb); ext4_group_t real_ngroups = ext4_get_groups_count(sb); int inodes_per_group = EXT4_INODES_PER_GROUP(sb); - unsigned int freei, avefreei, grp_free; + unsigned int freei, avefreei; ext4_fsblk_t freeb, avefreec; unsigned int ndirs; int max_dirs, min_inodes; @@ -399,6 +399,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent, struct orlov_stats stats; int flex_size = ext4_flex_bg_size(sbi); struct dx_hash_info hinfo; + unsigned int grp_free = 0; ngroups = real_ngroups; if (flex_size > 1) { @@ -508,7 +509,8 @@ fallback_retry: for (i = 0; i < ngroups; i++) { grp = (parent_group + i) % ngroups; desc = ext4_get_group_desc(sb, grp, NULL); - grp_free = ext4_free_inodes_count(sb, desc); + if (desc) + grp_free = ext4_free_inodes_count(sb, desc); if (desc && grp_free && grp_free >= avefreei) { *group = grp; return 0;