The patch titled ecryptfs: initialize private persistent file before dereferencing pointer has been added to the -mm tree. Its filename is ecryptfs-initialize-private-persistent-file-before-dereferencing-pointer.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: ecryptfs: initialize private persistent file before dereferencing pointer From: Erez Zadok <ezk@xxxxxxxxxxxxx> Ecryptfs_open dereferences a pointer to the private lower file (the one stored in the ecryptfs inode), without checking if the pointer is NULL. Right afterward, it initializes that pointer if it is NULL. Swap order of statements to first initialize. Bug discovered by Duckjin Kang. Signed-off-by: Duckjin Kang <fromdj2k@xxxxxxxxx> Signed-off-by: Erez Zadok <ezk@xxxxxxxxxxxxx> Cc: Tyler Hicks <tyhicks@xxxxxxxxxxxxxxxxxx> Cc: Dustin Kirkland <kirkland@xxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/ecryptfs/file.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff -puN fs/ecryptfs/file.c~ecryptfs-initialize-private-persistent-file-before-dereferencing-pointer fs/ecryptfs/file.c --- a/fs/ecryptfs/file.c~ecryptfs-initialize-private-persistent-file-before-dereferencing-pointer +++ a/fs/ecryptfs/file.c @@ -191,13 +191,6 @@ static int ecryptfs_open(struct inode *i | ECRYPTFS_ENCRYPTED); } mutex_unlock(&crypt_stat->cs_mutex); - if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_RDONLY) - && !(file->f_flags & O_RDONLY)) { - rc = -EPERM; - printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs " - "file must hence be opened RO\n", __func__); - goto out; - } if (!ecryptfs_inode_to_private(inode)->lower_file) { rc = ecryptfs_init_persistent_file(ecryptfs_dentry); if (rc) { @@ -208,6 +201,13 @@ static int ecryptfs_open(struct inode *i goto out; } } + if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_RDONLY) + && !(file->f_flags & O_RDONLY)) { + rc = -EPERM; + printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs " + "file must hence be opened RO\n", __func__); + goto out; + } ecryptfs_set_file_lower( file, ecryptfs_inode_to_private(inode)->lower_file); if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) { _ Patches currently in -mm which might be from ezk@xxxxxxxxxxxxx are ecryptfs-initialize-private-persistent-file-before-dereferencing-pointer.patch fsstack-ecryptfs-remove-unused-get_nlinks-param-to-fsstack_copy_attr_all.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html