From mboxrd@z Thu Jan  1 00:00:00 1970
From: Tero Roponen <tero.roponen@gmail.com>
Subject: Suspicious code in fs/dcache.c:d_delete
Date: Fri, 24 Feb 2012 19:03:16 +0200 (EET)
Message-ID: <alpine.LFD.2.02.1202241901340.4051@terrop>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Cc: viro@zeniv.linux.org.uk
To: linux-fsdevel@vger.kernel.org
Return-path: <linux-fsdevel-owner@vger.kernel.org>
Received: from mail-lpp01m010-f46.google.com ([209.85.215.46]:46736 "EHLO
	mail-lpp01m010-f46.google.com" rhost-flags-OK-OK-OK-OK)
	by vger.kernel.org with ESMTP id S1753624Ab2BXRDW (ORCPT
	<rfc822;linux-fsdevel@vger.kernel.org>);
	Fri, 24 Feb 2012 12:03:22 -0500
Received: by lagu2 with SMTP id u2so3017081lag.19
        for <linux-fsdevel@vger.kernel.org>; Fri, 24 Feb 2012 09:03:21 -0800 (PST)
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>


While reading the code in fs directory I found some questionable
code:

void d_delete(struct dentry * dentry)
{
	...

	inode = dentry->d_inode;
	isdir = S_ISDIR(inode->i_mode);
	if (dentry->d_count == 1) {
		if (inode && !spin_trylock(&inode->i_lock)) {
			spin_unlock(&dentry->d_lock);

	...
}

If inode can become NULL here then dereferencing it without
checking in S_ISDIR(inode->i_mode) is wrong. If it cannot be NULL
then testing it in 'if (inode && !spin_...)' is not needed.

-- 
Tero Roponen