cifs: dereferencing first then checking (d3892294) · Commits · 戴 / test

This patch is based on Dan's original patch. His original description is below: Smatch complained about a couple checking for NULL after dereferencing bugs. I'm not super familiar with the code so I did the conservative thing and move the dereferences after the checks. The dereferences in cifs_lock() and cifs_fsync() were added in "cifs: make various routines use the cifsFileInfo->tcon pointer". The dereference in find_writable_file() was added in "cifs: have find_readable/writable_file filter by fsuid". The comments there say it's possible to trigger the NULL dereference under stress. Signed-off-by:

Dan Carpenter <error27@gmail.com> Signed-off-by:

Jeff Layton <jlayton@redhat.com> Signed-off-by:

Steve French <sfrench@us.ibm.com>

fs/cifs/file.c

+3 −7

Original line number	Diff line number	Diff line
		@@ -754,12 +754,6 @@ int cifs_lock(struct file file, int cmd, struct file_lock pfLock)

		cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
		tcon = tlink_tcon(((struct cifsFileInfo *)file->private_data)->tlink);

		if (file->private_data == NULL) {
		rc = -EBADF;
		FreeXid(xid);
		return rc;
		}
		netfid = ((struct cifsFileInfo *)file->private_data)->netfid;

		if ((tcon->ses->capabilities & CAP_UNIX) &&
		@@ -1154,7 +1148,7 @@ struct cifsFileInfo find_writable_file(struct cifsInodeInfo cifs_inode,
		bool fsuid_only)
		{
		struct cifsFileInfo *open_file;
		struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
		struct cifs_sb_info *cifs_sb;
		bool any_available = false;
		int rc;

		@@ -1168,6 +1162,8 @@ struct cifsFileInfo find_writable_file(struct cifsInodeInfo cifs_inode,
		return NULL;
		}

		cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);

		/* only filter by fsuid on multiuser mounts */
		if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
		fsuid_only = false;

Admin message