From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Subject: [PATCH] configfs: Fix potential NULL d_inode dereference Date: Tue, 27 Jan 2015 15:18:39 +0000 Message-ID: <20150127151839.31483.83547.stgit@warthog.procyon.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Cc: dhowells@redhat.com, linux-fsdevel@vger.kernel.org, Joel Becker , linux-kernel@vger.kernel.org To: viro@zeniv.linux.org.uk Return-path: Sender: linux-kernel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org Code that does this: if (!(d_unhashed(dentry) && dentry->d_inode)) { ... simple_unlink(parent->d_inode, dentry); } is broken because: !(d_unhashed(dentry) && dentry->d_inode) is equivalent to: !d_unhashed(dentry) || !dentry->d_inode so it is possible to get into simple_unlink() with dentry->d_inode == NULL. simple_unlink(), however, assumes dentry->d_inode cannot be NULL. I think that what was meant is this: !d_unhashed(dentry) && dentry->d_inode and that the logical-not operator or the final close-bracket was misplaced. Signed-off-by: David Howells cc: Joel Becker --- fs/configfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/configfs/inode.c b/fs/configfs/inode.c index 5946ad98053f..e5a7c18a9bee 100644 --- a/fs/configfs/inode.c +++ b/fs/configfs/inode.c @@ -249,7 +249,7 @@ void configfs_drop_dentry(struct configfs_dirent * sd, struct dentry * parent) if (dentry) { spin_lock(&dentry->d_lock); - if (!(d_unhashed(dentry) && dentry->d_inode)) { + if (!d_unhashed(dentry) && dentry->d_inode) { dget_dlock(dentry); __d_drop(dentry); spin_unlock(&dentry->d_lock);