diff options
author | Jesper Juhl <jj@chaosbits.net> | 2010-12-25 21:22:30 +0000 |
---|---|---|
committer | Chris Mason <chris.mason@oracle.com> | 2011-01-16 11:30:20 -0500 |
commit | ff175d57f057f77d2d3031d674c2af9167a4af02 (patch) | |
tree | ff04961d44566d7abc3ea4aab888900d40561c3e /fs | |
parent | 20b450773d17e325190c158e10bfdb25dc21d2d6 (diff) | |
download | op-kernel-dev-ff175d57f057f77d2d3031d674c2af9167a4af02.zip op-kernel-dev-ff175d57f057f77d2d3031d674c2af9167a4af02.tar.gz |
btrfs: Don't pass NULL ptr to func that may deref it.
Hi,
In fs/btrfs/inode.c::fixup_tree_root_location() we have this code:
...
if (!path) {
err = -ENOMEM;
goto out;
}
...
out:
btrfs_free_path(path);
return err;
btrfs_free_path() passes its argument on to other functions and some of
them end up dereferencing the pointer.
In the code above that pointer is clearly NULL, so btrfs_free_path() will
eventually cause a NULL dereference.
There are many ways to cut this cake (fix the bug). The one I chose was to
make btrfs_free_path() deal gracefully with NULL pointers. If you
disagree, feel free to come up with an alternative patch.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Diffstat (limited to 'fs')
-rw-r--r-- | fs/btrfs/ctree.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index 9ac1715..99599f1 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -105,6 +105,8 @@ noinline void btrfs_clear_path_blocking(struct btrfs_path *p, /* this also releases the path */ void btrfs_free_path(struct btrfs_path *p) { + if (!p) + return; btrfs_release_path(NULL, p); kmem_cache_free(btrfs_path_cachep, p); } |