Eric Lee / linux-smarc-t335x-v3.2

Download as
Browse Code ยป

Commit 3dc8fe4dca9cd3e4aa828ed36451e2bcfd2350da

Authored by Jesper Juhl
Committed by Al Viro
1 parent e7854723d0
Exists in master and in 4 other branches v3.2_AM335xPSP_04.06.00.11, v3.2_NEWT335xPSP_04.06.00.11, v3.2_SBC_SMARTMEN, v3.2_SMARCT335xPSP_04.06.00.11

autofs4: Do not potentially dereference NULL pointer returned by fget() in autof… 

…s_dev_ioctl_setpipefd()

In fs/autofs4/dev-ioctl.c::autofs_dev_ioctl_setpipefd() we call fget(),
which may return NULL, but we do not explicitly test for that NULL return
so we may end up dereferencing a NULL pointer - bad.

When I originally submitted this patch I had chosen EBUSY as the return
value to use if this happens. Ian Kent was kind enough to explain why that
would most likely be wrong and why EBADF should most likely be used
instead. This version of the patch uses EBADF.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Ian Kent <raven@themaw.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Showing 1 changed file with 4 additions and 0 deletions Side-by-side Diff

fs/autofs4/dev-ioctl.c
Diff comments   View file @ 3dc8fe4
... ... @@ -372,6 +372,10 @@
372 372 return -EBUSY;
373 373 } else {
374 374 struct file *pipe = fget(pipefd);
  375 + if (!pipe) {
  376 + err = -EBADF;
  377 + goto out;
  378 + }
375 379 if (!pipe->f_op || !pipe->f_op->write) {
376 380 err = -EPIPE;
377 381 fput(pipe);