From: Colin Ian King <colin.king@xxxxxxxxxxxxx> commit 05a444d3f90a3c3e6362e88a1bf13e1a60f8cace upstream. Currently in the case where kmem_cache_alloc fails the null pointer cf is dereferenced when assigning cf->is_capsnap = false. Fix this by adding a null pointer check and return path. Cc: stable@xxxxxxxxxxxxxxx Addresses-Coverity: ("Dereference null return") Fixes: b2f9fa1f3bd8 ("ceph: correctly handle releasing an embedded cap flush") Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx> Reviewed-by: Ilya Dryomov <idryomov@xxxxxxxxx> Signed-off-by: Ilya Dryomov <idryomov@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/ceph/caps.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -1746,6 +1746,9 @@ struct ceph_cap_flush *ceph_alloc_cap_fl struct ceph_cap_flush *cf; cf = kmem_cache_alloc(ceph_cap_flush_cachep, GFP_KERNEL); + if (!cf) + return NULL; + cf->is_capsnap = false; return cf; }