diff options
| author | Jeff Layton <jlayton@redhat.com> | 2010-11-02 16:22:50 -0400 |
|---|---|---|
| committer | Steve French <sfrench@us.ibm.com> | 2010-11-04 19:39:07 +0000 |
| commit | d38922949d377da7d47473c7868334408ae3b373 (patch) | |
| tree | 322cf984f274c45da08d57acc74d29bb5c5e5048 /fs/cifs/file.c | |
| parent | 6ef933a38ade555a175ecab9d803e6bb73399763 (diff) | |
| download | kernel_samsung_aries-d38922949d377da7d47473c7868334408ae3b373.zip kernel_samsung_aries-d38922949d377da7d47473c7868334408ae3b373.tar.gz kernel_samsung_aries-d38922949d377da7d47473c7868334408ae3b373.tar.bz2 | |
cifs: dereferencing first then checking
This patch is based on Dan's original patch. His original description is
below:
Smatch complained about a couple checking for NULL after dereferencing
bugs. I'm not super familiar with the code so I did the conservative
thing and move the dereferences after the checks.
The dereferences in cifs_lock() and cifs_fsync() were added in
ba00ba64cf0 "cifs: make various routines use the cifsFileInfo->tcon
pointer". The dereference in find_writable_file() was added in
6508d904e6f "cifs: have find_readable/writable_file filter by fsuid".
The comments there say it's possible to trigger the NULL dereference
under stress.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Diffstat (limited to 'fs/cifs/file.c')
| -rw-r--r-- | fs/cifs/file.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/fs/cifs/file.c b/fs/cifs/file.c index 71185d1..777e7f4 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -754,12 +754,6 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock) cifs_sb = CIFS_SB(file->f_path.dentry->d_sb); tcon = tlink_tcon(((struct cifsFileInfo *)file->private_data)->tlink); - - if (file->private_data == NULL) { - rc = -EBADF; - FreeXid(xid); - return rc; - } netfid = ((struct cifsFileInfo *)file->private_data)->netfid; if ((tcon->ses->capabilities & CAP_UNIX) && @@ -1154,7 +1148,7 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode, bool fsuid_only) { struct cifsFileInfo *open_file; - struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb); + struct cifs_sb_info *cifs_sb; bool any_available = false; int rc; @@ -1168,6 +1162,8 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode, return NULL; } + cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb); + /* only filter by fsuid on multiuser mounts */ if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER)) fsuid_only = false; |