Messages in this thread | | | Subject | Re: [PATCH][next] ovl: fix null pointer dereference on null stack pointer on error return | From | Colin Ian King <> | Date | Thu, 4 Jun 2020 10:27:38 +0100 |
| |
On 04/06/2020 08:25, Miklos Szeredi wrote: > On Wed, Jun 3, 2020 at 6:15 PM Colin Ian King <colin.king@canonical.com> wrote: >> >> On 03/06/2020 17:11, Amir Goldstein wrote: >>> On Wed, Jun 3, 2020 at 6:46 PM Colin King <colin.king@canonical.com> wrote: >>>> >>>> From: Colin Ian King <colin.king@canonical.com> >>>> >>>> There are two error return paths where the call to path_put is >>>> dereferencing the null pointer 'stack'. Fix this by avoiding the >>>> error exit path via label 'out_err' that will lead to the path_put >>>> calls and instead just return the error code directly. >>>> >>>> Addresses-Coverity: ("Dereference after null check)" >>>> Fixes: 4155c10a0309 ("ovl: clean up getting lower layers") >>>> Signed-off-by: Colin Ian King <colin.king@canonical.com> >>> >>> >>> Which branch is that based on? >>> Doesn't seem to apply to master nor next >> >> It was based on today's linux-next > > Yeah, it's actually > > Fixes: 73819e26c0f0 ("ovl: get rid of redundant members in struct ovl_fs") > > So I'll just fold your patch. There's still a change in the loop > count for later errors, but that's okay, since > ovl_lower_dir()/ovl_mount_dir_noesc() use the path_put_init() variant. > Actually ovl_lower_dir() can get rid of that path_put_init() > completely, since now the only caller will take care of that... > > Thanks for reporting! > > Miklos > Is there a reason for folding the fix and hence losing the Signed-off-by tag?
Colin
| |