Attachment 144947 Details for Bug 217008 – New proposed patch

[patch] New proposed patch

fuzzer_fix (text/plain), 1.66 KB, created by Russell Cattelan on 2007-01-06 00:12:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Russell Cattelan

Created: 2007-01-06 00:12:38 UTC

Size: 1.66 KB

patch

obsolete

>Change gfs2_lookupi to either return an inode or an error.
>None of the callers of gfs2_lookupi expect a NULL on error
>and such would end up dereferencing all NULL ptr.
>
>This fixes:
>http://projects.info-pull.com/mokb/MOKB-15-11-2006.html
>
>Signed-off-by: Russell Cattelan <cattelan@xfs.org>
>Index: gfs2_A/fs/gfs2/inode.c
>===================================================================
>--- gfs2_A.orig/fs/gfs2/inode.c	2007-01-04 19:43:11.710338114 -0600
>+++ gfs2_A/fs/gfs2/inode.c	2007-01-05 11:57:11.788439717 -0600
>@@ -406,20 +406,22 @@ struct inode *gfs2_lookupi(struct inode 
> 
> 	if (!is_root) {
> 		error = permission(dir, MAY_EXEC, NULL);
>-		if (error)
>+		if (error) {
>+			inode = ERR_PTR(error);
> 			goto out;
>+		}
> 	}
> 
> 	error = gfs2_dir_search(dir, name, &inum, &type);
>-	if (error)
>+	if (error) {
>+		inode = ERR_PTR(error);
> 		goto out;
>+	}
> 
> 	inode = gfs2_inode_lookup(sb, &inum, type);
> 
> out:
> 	gfs2_glock_dq_uninit(&d_gh);
>-	if (error == -ENOENT)
>-		return NULL;
> 	return inode;
> }
> 
>Index: gfs2_A/fs/gfs2/ops_export.c
>===================================================================
>--- gfs2_A.orig/fs/gfs2/ops_export.c	2006-12-19 20:05:01.000000000 -0600
>+++ gfs2_A/fs/gfs2/ops_export.c	2007-01-04 19:51:20.708282759 -0600
>@@ -174,13 +174,11 @@ static struct dentry *gfs2_get_parent(st
> 	gfs2_str2qstr(&dotdot, "..");
> 	inode = gfs2_lookupi(child->d_inode, &dotdot, 1, NULL);
> 
>-	if (!inode)
>-		return ERR_PTR(-ENOENT);
> 	/*
> 	 * In case of an error, @inode carries the error value, and we
> 	 * have to return that as a(n invalid) pointer to dentry.
> 	 */
>-	if (IS_ERR(inode))
>+	if (inode && IS_ERR(inode))
> 		return ERR_PTR(PTR_ERR(inode));
> 
> 	dentry = d_alloc_anon(inode);

Actions: View | Diff

Attachments on bug 217008: 144912 | 144947