[patch 06/43] fuse: fix NULL deref in fuse_file_alloc()

Greg KH
2009-01-31T03:00:55Z

[-- Attachment #1: fuse-fix-null-deref-in-fuse_file_alloc.patch --]
[-- Type: text/plain, Size: 804 bytes --]

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dan Carpenter <error27@gmail.com>

commit bb875b38dc5e343bdb696b2eab8233e4d195e208 upstream.

ff is set to NULL and then dereferenced on line 65. Compile tested only.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
fs/fuse/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -54,7 +54,7 @@ struct fuse_file *fuse_file_alloc(void)
ff->reserved_req = fuse_request_alloc();
if (!ff->reserved_req) {
kfree(ff);
- ff = NULL;
+ return NULL;
} else {
INIT_LIST_HEAD(&ff->write_entry);
atomic_set(&ff->count, 0);