* [PATCH] configfs: Fix potential NULL d_inode dereference
@ 2015-01-27 15:18 David Howells
0 siblings, 0 replies; only message in thread
From: David Howells @ 2015-01-27 15:18 UTC (permalink / raw)
To: viro; +Cc: dhowells, linux-fsdevel, Joel Becker, linux-kernel
Code that does this:
if (!(d_unhashed(dentry) && dentry->d_inode)) {
...
simple_unlink(parent->d_inode, dentry);
}
is broken because:
!(d_unhashed(dentry) && dentry->d_inode)
is equivalent to:
!d_unhashed(dentry) || !dentry->d_inode
so it is possible to get into simple_unlink() with dentry->d_inode == NULL.
simple_unlink(), however, assumes dentry->d_inode cannot be NULL.
I think that what was meant is this:
!d_unhashed(dentry) && dentry->d_inode
and that the logical-not operator or the final close-bracket was misplaced.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Joel Becker <joel.becker@oracle.com>
---
fs/configfs/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/configfs/inode.c b/fs/configfs/inode.c
index 5946ad98053f..e5a7c18a9bee 100644
--- a/fs/configfs/inode.c
+++ b/fs/configfs/inode.c
@@ -249,7 +249,7 @@ void configfs_drop_dentry(struct configfs_dirent * sd, struct dentry * parent)
if (dentry) {
spin_lock(&dentry->d_lock);
- if (!(d_unhashed(dentry) && dentry->d_inode)) {
+ if (!d_unhashed(dentry) && dentry->d_inode) {
dget_dlock(dentry);
__d_drop(dentry);
spin_unlock(&dentry->d_lock);
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2015-01-27 15:18 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-01-27 15:18 [PATCH] configfs: Fix potential NULL d_inode dereference David Howells
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).