lkml.org 
[lkml]   [2010]   [Dec]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH] autofs4: Do not potentially dereference NULL pointer returned by fget() in autofs_dev_ioctl_setpipefd()
    From
    Date
    On Sat, 2010-12-18 at 22:43 +0100, Jesper Juhl wrote:
    > Hi,
    >
    > In fs/autofs4/dev-ioctl.c::autofs_dev_ioctl_setpipefd() we call fget(),
    > which may return NULL, but we do not explicitly test for that NULL return
    > so we may end up dereferencing a NULL pointer - bad.
    >
    > When I originally submitted this patch I had chosen EBUSY as the return
    > value to use if this happens. Ian Kent was kind enough to explain why that
    > would most likely be wrong and why EBADF should most likely be used
    > instead. This version of the patch uses EBADF.
    >
    >
    > Signed-off-by: Jesper Juhl <jj@chaosbits.net>
    Acked-by: Ian Kent <raven@themaw.net>

    > ---
    > dev-ioctl.c | 4 ++++
    > 1 file changed, 4 insertions(+)
    >
    > diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
    > index eff9a41..a650d7e 100644
    > --- a/fs/autofs4/dev-ioctl.c
    > +++ b/fs/autofs4/dev-ioctl.c
    > @@ -372,6 +372,10 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
    > return -EBUSY;
    > } else {
    > struct file *pipe = fget(pipefd);
    > + if (!pipe) {
    > + err = -EBADF;
    > + goto out;
    > + }
    > if (!pipe->f_op || !pipe->f_op->write) {
    > err = -EPIPE;
    > fput(pipe);
    >
    >
    >




    \
     
     \ /
      Last update: 2010-12-28 03:39    [W:0.020 / U:0.804 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site