[lkml]   [2010]   [Dec]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH] autofs4: Do not potentially dereference NULL pointer returned by fget() in autofs_dev_ioctl_setpipefd()

    In fs/autofs4/dev-ioctl.c::autofs_dev_ioctl_setpipefd() we call fget(),
    which may return NULL, but we do not explicitly test for that NULL return
    so we may end up dereferencing a NULL pointer - bad.

    When I originally submitted this patch I had chosen EBUSY as the return
    value to use if this happens. Ian Kent was kind enough to explain why that
    would most likely be wrong and why EBADF should most likely be used
    instead. This version of the patch uses EBADF.

    Signed-off-by: Jesper Juhl <>
    dev-ioctl.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
    index eff9a41..a650d7e 100644
    --- a/fs/autofs4/dev-ioctl.c
    +++ b/fs/autofs4/dev-ioctl.c
    @@ -372,6 +372,10 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
    return -EBUSY;
    } else {
    struct file *pipe = fget(pipefd);
    + if (!pipe) {
    + err = -EBADF;
    + goto out;
    + }
    if (!pipe->f_op || !pipe->f_op->write) {
    err = -EPIPE;

    Jesper Juhl <>
    Don't top-post
    Plain text mails only, please.

     \ /
      Last update: 2010-12-18 22:55    [W:0.037 / U:10.180 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site