diff options
author | Jesper Juhl <jj@chaosbits.net> | 2012-04-12 22:47:52 +0200 |
---|---|---|
committer | David Sterba <dsterba@suse.cz> | 2012-04-18 19:22:20 +0200 |
commit | 4735fb282830c0966b301dabcccf4753fa6604bb (patch) | |
tree | 1749491d41f888c29dbad6de37fe3fbe81a38fc3 | |
parent | Btrfs: avoid possible use-after-free in clear_extent_bit() (diff) | |
download | linux-4735fb282830c0966b301dabcccf4753fa6604bb.tar.xz linux-4735fb282830c0966b301dabcccf4753fa6604bb.zip |
Btrfs: Make free_ipath() deal gracefully with NULL pointers
Make free_ipath() behave like most other freeing functions in the
kernel and gracefully do nothing when passed a NULL pointer.
Besides this making the bahaviour consistent with functions such as
kfree(), vfree(), btrfs_free_path() etc etc, it also fixes a real NULL
deref issue in fs/btrfs/ioctl.c::btrfs_ioctl_ino_to_path(). In that
function we have this code:
...
ipath = init_ipath(size, root, path);
if (IS_ERR(ipath)) {
ret = PTR_ERR(ipath);
ipath = NULL;
goto out;
}
...
out:
btrfs_free_path(path);
free_ipath(ipath);
...
If we ever take the true branch of that 'if' statement we'll end up
passing a NULL pointer to free_ipath() which will subsequently
dereference it and we'll go "Boom" :-(
This patch will avoid that.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
-rw-r--r-- | fs/btrfs/backref.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c index f4e90748940a..b332ff04c5ee 100644 --- a/fs/btrfs/backref.c +++ b/fs/btrfs/backref.c @@ -1414,6 +1414,8 @@ struct inode_fs_paths *init_ipath(s32 total_bytes, struct btrfs_root *fs_root, void free_ipath(struct inode_fs_paths *ipath) { + if (!ipath) + return; kfree(ipath->fspath); kfree(ipath); } |