Commit e073fc58 authored Apr 14, 2015 by Dan Carpenter Committed by Linus Torvalds Apr 14, 2015

ocfs2: dereferencing freed pointers in ocfs2_reflink()



The code at the "out" label assumes that "default_acl" and "acl" are NULL,
but actually the pointers can be NULL, unitialized, or freed.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Mark Fasheh <mfasheh@suse.de>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent d0ba25b9

fs/ocfs2/refcounttree.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -4276,7 +4276,7 @@ static int ocfs2_reflink(struct dentry old_dentry, struct inode dir,
		error = posix_acl_create(dir, &mode, &default_acl, &acl);
		if (error) {
		mlog_errno(error);
		goto out;
		return error;
		}

		error = ocfs2_create_inode_in_orphan(dir, mode,