leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ceph: avoid possible null deref in readdir after dir llseek

Browse Source 
last may be NULL, but we dereference it in the else branch without
checking.  Normally it doesn't trigger because last == NULL when fpos == 2,
but it could happen on a newly opened dir if the user seeks forward.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Sage Weil <sage@newdream.net>
This commit is contained in:
Sage Weil 2010-11-22 22:58:06 -08:00
parent 3561d43fd2
commit 884ea89276
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/ceph/dir.c
View File

@ -114,8 +114,8 @@ static int __dcache_readdir(struct file *filp,
spin_lock(&dcache_lock);
/* start at beginning? */
if (filp->f_pos == 2 || (last &&
filp->f_pos < ceph_dentry(last)->offset)) {
if (filp->f_pos == 2 || last == NULL ||
filp->f_pos < ceph_dentry(last)->offset) {
if (list_empty(&parent->d_subdirs))
goto out_unlock;
p = parent->d_subdirs.prev;