On Tue 15-05-12 11:46:40, Dan Carpenter wrote:
> The ext4_get_group_desc() function returns NULL on error, and
> ext4_free_inodes_count() function dereferences it without checking.
> There is a check on the next line, but it's too late.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Looks good. Thanks! You can add:
Reviewed-by: Jan Kara <jack@xxxxxxx>
Honza
> ---
> v2: cleaned up the style
>
> diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
> index a044a9b..ea32d7e 100644
> --- a/fs/ext4/ialloc.c
> +++ b/fs/ext4/ialloc.c
> @@ -508,10 +508,12 @@ fallback_retry:
> for (i = 0; i < ngroups; i++) {
> grp = (parent_group + i) % ngroups;
> desc = ext4_get_group_desc(sb, grp, NULL);
> - grp_free = ext4_free_inodes_count(sb, desc);
> - if (desc && grp_free && grp_free >= avefreei) {
> - *group = grp;
> - return 0;
> + if (desc) {
> + grp_free = ext4_free_inodes_count(sb, desc);
> + if (grp_free && grp_free >= avefreei) {
> + *group = grp;
> + return 0;
> + }
> }
> }
>
--
Jan Kara <jack@xxxxxxx>
SUSE Labs, CR
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
