diff mbox

CIFS: Fix ERR_PTR dereference in cifs_get_root

Message ID 1313940615-3347-1-git-send-email-piastryyy@gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Pavel Shilovsky Aug. 21, 2011, 3:30 p.m. UTC
move it to the beginning of the loop.

Signed-off-by: Pavel Shilovsky <piastryyy@gmail.com>
---
 fs/cifs/cifsfs.c |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

Comments

Jeff Layton Aug. 21, 2011, 4:22 p.m. UTC | #1
On Sun, 21 Aug 2011 19:30:15 +0400
Pavel Shilovsky <piastryyy@gmail.com> wrote:

> move it to the beginning of the loop.
> 
> Signed-off-by: Pavel Shilovsky <piastryyy@gmail.com>
> ---
>  fs/cifs/cifsfs.c |   10 ++++++----
>  1 files changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
> index 0435bb9..8b79122 100644
> --- a/fs/cifs/cifsfs.c
> +++ b/fs/cifs/cifsfs.c
> @@ -559,6 +559,12 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
>  		struct inode *dir = dentry->d_inode;
>  		struct dentry *child;
>  
> +		if (!dir) {
> +			dput(dentry);
> +			dentry = ERR_PTR(-ENOENT);
> +			break;
> +		}
> +
>  		/* skip separators */
>  		while (*s == sep)
>  			s++;
> @@ -574,10 +580,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
>  		mutex_unlock(&dir->i_mutex);
>  		dput(dentry);
>  		dentry = child;
> -		if (!dentry->d_inode) {
> -			dput(dentry);
> -			dentry = ERR_PTR(-ENOENT);
> -		}
>  	} while (!IS_ERR(dentry));
>  	_FreeXid(xid);
>  	kfree(full_path);

What exactly does this fix? The only possible thing I could see it is
if sb->s_root was a negative dentry, and I'm not sure that would ever
happen. Would it?
Jeff Layton Aug. 24, 2011, 11:30 a.m. UTC | #2
On Sun, 21 Aug 2011 12:22:51 -0400
Jeff Layton <jlayton@samba.org> wrote:

> On Sun, 21 Aug 2011 19:30:15 +0400
> Pavel Shilovsky <piastryyy@gmail.com> wrote:
> 
> > move it to the beginning of the loop.
> > 
> > Signed-off-by: Pavel Shilovsky <piastryyy@gmail.com>
> > ---
> >  fs/cifs/cifsfs.c |   10 ++++++----
> >  1 files changed, 6 insertions(+), 4 deletions(-)
> > 
> > diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
> > index 0435bb9..8b79122 100644
> > --- a/fs/cifs/cifsfs.c
> > +++ b/fs/cifs/cifsfs.c
> > @@ -559,6 +559,12 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
> >  		struct inode *dir = dentry->d_inode;
> >  		struct dentry *child;
> >  
> > +		if (!dir) {
> > +			dput(dentry);
> > +			dentry = ERR_PTR(-ENOENT);
> > +			break;
> > +		}
> > +
> >  		/* skip separators */
> >  		while (*s == sep)
> >  			s++;
> > @@ -574,10 +580,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
> >  		mutex_unlock(&dir->i_mutex);
> >  		dput(dentry);
> >  		dentry = child;
> > -		if (!dentry->d_inode) {
> > -			dput(dentry);
> > -			dentry = ERR_PTR(-ENOENT);
> > -		}
> >  	} while (!IS_ERR(dentry));
> >  	_FreeXid(xid);
> >  	kfree(full_path);
> 
> What exactly does this fix? The only possible thing I could see it is
> if sb->s_root was a negative dentry, and I'm not sure that would ever
> happen. Would it?
> 

Ahh, nevermind. I see the issue...

If IS_ERR(dentry) is true then we definitely don't want to try and
dereference the inode. This needs to go into 3.1 and stable as well.

Reviewed-by: Jeff Layton <jlayton@redhat.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 0435bb9..8b79122 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -559,6 +559,12 @@  cifs_get_root(struct smb_vol *vol, struct super_block *sb)
 		struct inode *dir = dentry->d_inode;
 		struct dentry *child;
 
+		if (!dir) {
+			dput(dentry);
+			dentry = ERR_PTR(-ENOENT);
+			break;
+		}
+
 		/* skip separators */
 		while (*s == sep)
 			s++;
@@ -574,10 +580,6 @@  cifs_get_root(struct smb_vol *vol, struct super_block *sb)
 		mutex_unlock(&dir->i_mutex);
 		dput(dentry);
 		dentry = child;
-		if (!dentry->d_inode) {
-			dput(dentry);
-			dentry = ERR_PTR(-ENOENT);
-		}
 	} while (!IS_ERR(dentry));
 	_FreeXid(xid);
 	kfree(full_path);