Messages in this thread Patch in this message | | | From | (Eric W. Biederman) | Date | Sun, 10 Aug 2014 20:25:39 -0700 | Subject | Re: [PATCH] proc: potential ERR_PTR dereference on proc_fill_cache() |
| |
Daeseok Youn <daeseok.youn@gmail.com> writes:
> The d_hash_and_lookup() returns NULL or ERR_PTR on lookup > failure.
Given that the only error condition can come from .d_hash and that proc does not implement .d_hash if we want to do something with error returns let's call BUG_ON. aka:
diff --git a/fs/proc/base.c b/fs/proc/base.c index f50d4be..49bc09c 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1673,7 +1673,7 @@ bool proc_fill_cache(struct file *file, struct dir_context *ctx, ino_t ino; child = d_hash_and_lookup(dir, &qname); + BUG_ON(IS_ERR(child)) if (!child) { child = d_alloc(dir, &qname); if (!child) goto end_instantiate;
Or do you see something in d_hash_and_lookup that I am overlooking? Eric
> Signed-off-by: Daeseok Youn <daeseok.youn@gmail.com> > --- > fs/proc/base.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/fs/proc/base.c b/fs/proc/base.c > index f50d4be..49bc09c 100644 > --- a/fs/proc/base.c > +++ b/fs/proc/base.c > @@ -1673,7 +1673,7 @@ bool proc_fill_cache(struct file *file, struct dir_context *ctx, > ino_t ino; > > child = d_hash_and_lookup(dir, &qname); > - if (!child) { > + if (IS_ERR_OR_NULL(child)) { > child = d_alloc(dir, &qname); > if (!child) > goto end_instantiate;
| |