From patchwork Tue May 15 08:46:40 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 159257 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 0E914B6FB7 for ; Tue, 15 May 2012 18:47:33 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758195Ab2EOIr2 (ORCPT ); Tue, 15 May 2012 04:47:28 -0400 Received: from rcsinet15.oracle.com ([148.87.113.117]:32999 "EHLO rcsinet15.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757898Ab2EOIr1 (ORCPT ); Tue, 15 May 2012 04:47:27 -0400 Received: from acsinet22.oracle.com (acsinet22.oracle.com [141.146.126.238]) by rcsinet15.oracle.com (Sentrion-MTA-4.2.2/Sentrion-MTA-4.2.2) with ESMTP id q4F8kmxQ024704 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 15 May 2012 08:46:49 GMT Received: from acsmt357.oracle.com (acsmt357.oracle.com [141.146.40.157]) by acsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id q4F8kmdM000155 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 15 May 2012 08:46:48 GMT Received: from abhmt113.oracle.com (abhmt113.oracle.com [141.146.116.65]) by acsmt357.oracle.com (8.12.11.20060308/8.12.11) with ESMTP id q4F8klgq026205; Tue, 15 May 2012 03:46:47 -0500 Received: from elgon.mountain (/41.139.221.94) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 15 May 2012 01:46:47 -0700 Date: Tue, 15 May 2012 11:46:40 +0300 From: Dan Carpenter To: "Theodore Ts'o" , Jan Kara Cc: Andreas Dilger , linux-ext4@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch v2] ext4: potential NULL dereference on error Message-ID: <20120515084640.GB30265@elgon.mountain> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20120514222535.GW5353@quack.suse.cz> User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: acsinet22.oracle.com [141.146.126.238] Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org The ext4_get_group_desc() function returns NULL on error, and ext4_free_inodes_count() function dereferences it without checking. There is a check on the next line, but it's too late. Signed-off-by: Dan Carpenter Reviewed-by: Jan Kara --- v2: cleaned up the style -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c index a044a9b..ea32d7e 100644 --- a/fs/ext4/ialloc.c +++ b/fs/ext4/ialloc.c @@ -508,10 +508,12 @@ fallback_retry: for (i = 0; i < ngroups; i++) { grp = (parent_group + i) % ngroups; desc = ext4_get_group_desc(sb, grp, NULL); - grp_free = ext4_free_inodes_count(sb, desc); - if (desc && grp_free && grp_free >= avefreei) { - *group = grp; - return 0; + if (desc) { + grp_free = ext4_free_inodes_count(sb, desc); + if (grp_free && grp_free >= avefreei) { + *group = grp; + return 0; + } } }