diff options
| author | Anand V. Avati <avati@gluster.com> | 2009-10-22 15:24:52 +0200 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@suse.cz> | 2009-11-04 10:24:50 +0100 |
| commit | f60311d5f7670d9539b424e4ed8b5c0872fc9e83 (patch) | |
| tree | e4289854a25f4640308532726deceb7d6ac293ed | |
| parent | Linux 2.6.32-rc6 (diff) | |
| download | linux-f60311d5f7670d9539b424e4ed8b5c0872fc9e83.tar.xz linux-f60311d5f7670d9539b424e4ed8b5c0872fc9e83.zip | |
fuse: prevent fuse_put_request on invalid pointer
fuse_direct_io() has a loop where requests are allocated in each
iteration. if allocation fails, the loop is broken out and follows
into an unconditional fuse_put_request() on that invalid pointer.
Signed-off-by: Anand V. Avati <avati@gluster.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Cc: stable@kernel.org
| -rw-r--r-- | fs/fuse/file.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/fuse/file.c b/fs/fuse/file.c index a3492f7d207c..5887a6395ad2 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -1063,7 +1063,8 @@ ssize_t fuse_direct_io(struct file *file, const char __user *buf, break; } } - fuse_put_request(fc, req); + if (!IS_ERR(req)) + fuse_put_request(fc, req); if (res > 0) *ppos = pos; |