btrfs: Don't pass NULL ptr to func that may deref it.
authorJesper Juhl <jj@chaosbits.net>
Sat, 25 Dec 2010 21:22:30 +0000 (21:22 +0000)
committerChris Mason <chris.mason@oracle.com>
Sun, 16 Jan 2011 16:30:20 +0000 (11:30 -0500)
Hi,

In fs/btrfs/inode.c::fixup_tree_root_location() we have this code:

...
  if (!path) {
  err = -ENOMEM;
  goto out;
  }
...
  out:
  btrfs_free_path(path);
  return err;

btrfs_free_path() passes its argument on to other functions and some of
them end up dereferencing the pointer.
In the code above that pointer is clearly NULL, so btrfs_free_path() will
eventually cause a NULL dereference.

There are many ways to cut this cake (fix the bug). The one I chose was to
make btrfs_free_path() deal gracefully with NULL pointers. If you
disagree, feel free to come up with an alternative patch.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
fs/btrfs/ctree.c

index 9ac17159925819a399dc10413d5261dd67bb5584..99599f1c15549791a2f3cb2d560c579be8c7b920 100644 (file)
@@ -105,6 +105,8 @@ noinline void btrfs_clear_path_blocking(struct btrfs_path *p,
 /* this also releases the path */
 void btrfs_free_path(struct btrfs_path *p)
 {
+       if (!p)
+               return;
        btrfs_release_path(NULL, p);
        kmem_cache_free(btrfs_path_cachep, p);
 }