Messages in this thread Patch in this message | | | From | youngjun <> | Subject | [PATCH] kernfs: fix possibility of NULL pointer dereference. | Date | Mon, 27 Apr 2020 09:48:36 -0700 |
| |
When dentry is negative, "kernfs_dentry_node" returns NULL. In this case, "kernfs_root" dereferences NULL pointer.
Signed-off-by: youngjun <her0gyugyu@gmail.com> --- fs/kernfs/dir.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c index 9aec80b9d7c6..02fb5cc76e33 100644 --- a/fs/kernfs/dir.c +++ b/fs/kernfs/dir.c @@ -1133,15 +1133,16 @@ static int kernfs_iop_mkdir(struct inode *dir, struct dentry *dentry, static int kernfs_iop_rmdir(struct inode *dir, struct dentry *dentry) { struct kernfs_node *kn = kernfs_dentry_node(dentry); - struct kernfs_syscall_ops *scops = kernfs_root(kn)->syscall_ops; + struct kernfs_syscall_ops *scops; int ret; - if (!scops || !scops->rmdir) - return -EPERM; - if (!kernfs_get_active(kn)) return -ENODEV; + scops = kernfs_root(kn)->syscall_ops; + if (!scops || !scops->rmdir) + return -EPERM; + ret = scops->rmdir(kn); kernfs_put_active(kn); @@ -1154,18 +1155,19 @@ static int kernfs_iop_rename(struct inode *old_dir, struct dentry *old_dentry, { struct kernfs_node *kn = kernfs_dentry_node(old_dentry); struct kernfs_node *new_parent = new_dir->i_private; - struct kernfs_syscall_ops *scops = kernfs_root(kn)->syscall_ops; + struct kernfs_syscall_ops *scops; int ret; if (flags) return -EINVAL; - if (!scops || !scops->rename) - return -EPERM; - if (!kernfs_get_active(kn)) return -ENODEV; + scops = kernfs_root(kn)->syscall_ops; + if (!scops || !scops->rename) + return -EPERM; + if (!kernfs_get_active(new_parent)) { kernfs_put_active(kn); return -ENODEV; -- 2.17.1
| |