Răsfoiți Sursa

ceph: avoid possible null deref in readdir after dir llseek

last may be NULL, but we dereference it in the else branch without
checking.  Normally it doesn't trigger because last == NULL when fpos == 2,
but it could happen on a newly opened dir if the user seeks forward.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Sage Weil <sage@newdream.net>
Sage Weil 14 ani în urmă
părinte
comite
884ea89276
1 a modificat fișierele cu 2 adăugiri și 2 ștergeri
  1. 2 2
      fs/ceph/dir.c

+ 2 - 2
fs/ceph/dir.c

@@ -114,8 +114,8 @@ static int __dcache_readdir(struct file *filp,
 	spin_lock(&dcache_lock);
 	spin_lock(&dcache_lock);
 
 
 	/* start at beginning? */
 	/* start at beginning? */
-	if (filp->f_pos == 2 || (last &&
-				 filp->f_pos < ceph_dentry(last)->offset)) {
+	if (filp->f_pos == 2 || last == NULL ||
+	    filp->f_pos < ceph_dentry(last)->offset) {
 		if (list_empty(&parent->d_subdirs))
 		if (list_empty(&parent->d_subdirs))
 			goto out_unlock;
 			goto out_unlock;
 		p = parent->d_subdirs.prev;
 		p = parent->d_subdirs.prev;