| Message ID | 20120515084640.GB30265@elgon.mountain |
|---|---|
| State | Accepted, archived |
| Headers | show |
On Tue 15-05-12 11:46:40, Dan Carpenter wrote: > The ext4_get_group_desc() function returns NULL on error, and > ext4_free_inodes_count() function dereferences it without checking. > There is a check on the next line, but it's too late. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Looks good. Thanks! You can add: Reviewed-by: Jan Kara <jack@suse.cz> Honza > --- > v2: cleaned up the style > > diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c > index a044a9b..ea32d7e 100644 > --- a/fs/ext4/ialloc.c > +++ b/fs/ext4/ialloc.c > @@ -508,10 +508,12 @@ fallback_retry: > for (i = 0; i < ngroups; i++) { > grp = (parent_group + i) % ngroups; > desc = ext4_get_group_desc(sb, grp, NULL); > - grp_free = ext4_free_inodes_count(sb, desc); > - if (desc && grp_free && grp_free >= avefreei) { > - *group = grp; > - return 0; > + if (desc) { > + grp_free = ext4_free_inodes_count(sb, desc); > + if (grp_free && grp_free >= avefreei) { > + *group = grp; > + return 0; > + } > } > } >
On Tue, May 15, 2012 at 11:46:40AM +0300, Dan Carpenter wrote: > The ext4_get_group_desc() function returns NULL on error, and > ext4_free_inodes_count() function dereferences it without checking. > There is a check on the next line, but it's too late. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Thanks, applied. - Ted -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c index a044a9b..ea32d7e 100644 --- a/fs/ext4/ialloc.c +++ b/fs/ext4/ialloc.c @@ -508,10 +508,12 @@ fallback_retry: for (i = 0; i < ngroups; i++) { grp = (parent_group + i) % ngroups; desc = ext4_get_group_desc(sb, grp, NULL); - grp_free = ext4_free_inodes_count(sb, desc); - if (desc && grp_free && grp_free >= avefreei) { - *group = grp; - return 0; + if (desc) { + grp_free = ext4_free_inodes_count(sb, desc); + if (grp_free && grp_free >= avefreei) { + *group = grp; + return 0; + } } }
The ext4_get_group_desc() function returns NULL on error, and ext4_free_inodes_count() function dereferences it without checking. There is a check on the next line, but it's too late. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- v2: cleaned up the style -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html