Re: [patch v2] ext4: potential NULL dereference on error

[Jan Kara <jack@suse.cz>]

On Tue 15-05-12 11:46:40, Dan Carpenter wrote:
> The ext4_get_group_desc() function returns NULL on error, and
> ext4_free_inodes_count() function dereferences it without checking.
> There is a check on the next line, but it's too late.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
  Looks good. Thanks! You can add:
Reviewed-by: Jan Kara <jack@suse.cz>

								Honza
> ---
> v2: cleaned up the style
> 
> diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
> index a044a9b..ea32d7e 100644
> --- a/fs/ext4/ialloc.c
> +++ b/fs/ext4/ialloc.c
> @@ -508,10 +508,12 @@ fallback_retry:
>  	for (i = 0; i < ngroups; i++) {
>  		grp = (parent_group + i) % ngroups;
>  		desc = ext4_get_group_desc(sb, grp, NULL);
> -		grp_free = ext4_free_inodes_count(sb, desc);
> -		if (desc && grp_free && grp_free >= avefreei) {
> -			*group = grp;
> -			return 0;
> +		if (desc) {
> +			grp_free = ext4_free_inodes_count(sb, desc);
> +			if (grp_free && grp_free >= avefreei) {
> +				*group = grp;
> +				return 0;
> +			}
>  		}
>  	}
>  
-- 
Jan Kara <jack@suse.cz>
SUSE Labs, CR