From 4408ea41c0ab4b711d4da44dd954fb06dce6c3f8 Mon Sep 17 00:00:00 2001 From: Jan Kara Date: Tue, 19 Oct 2010 00:24:21 +0200 Subject: quota: Fix possible oops in __dquot_initialize() When quotaon(8) races with __dquot_initialize() or dqget() fails because of EIO, ENOSPC, or similar error, we could possibly dereference NULL pointer in inode->i_dquot[cnt]. Add proper checking. Reported-by: Dmitry Monakhov Signed-off-by: Jan Kara --- fs/quota/dquot.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'fs') diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 1bc38f56fa7c..0fed41e6efcd 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -1386,6 +1386,9 @@ static void __dquot_initialize(struct inode *inode, int type) /* Avoid races with quotaoff() */ if (!sb_has_quota_active(sb, cnt)) continue; + /* We could race with quotaon or dqget() could have failed */ + if (!got[cnt]) + continue; if (!inode->i_dquot[cnt]) { inode->i_dquot[cnt] = got[cnt]; got[cnt] = NULL; -- cgit v1.2.3