Skip to content

Commit

Permalink
fs: NULL dereference in posix_acl_to_xattr()
Browse files Browse the repository at this point in the history
commit 47ba973 upstream.

This patch moves the dereference of "buffer" after the check for NULL.
The only place which passes a NULL parameter is gfs2_set_acl().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Dan Carpenter authored and Greg Kroah-Hartman committed Apr 27, 2014
1 parent c80e9ae commit d465455
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions fs/posix_acl.c
Original file line number Diff line number Diff line change
Expand Up @@ -723,15 +723,16 @@ posix_acl_to_xattr(struct user_namespace *user_ns, const struct posix_acl *acl,
void *buffer, size_t size)
{
posix_acl_xattr_header *ext_acl = (posix_acl_xattr_header *)buffer;
posix_acl_xattr_entry *ext_entry = ext_acl->a_entries;
posix_acl_xattr_entry *ext_entry;
int real_size, n;

real_size = posix_acl_xattr_size(acl->a_count);
if (!buffer)
return real_size;
if (real_size > size)
return -ERANGE;


ext_entry = ext_acl->a_entries;
ext_acl->a_version = cpu_to_le32(POSIX_ACL_XATTR_VERSION);

for (n=0; n < acl->a_count; n++, ext_entry++) {
Expand Down

0 comments on commit d465455

Please sign in to comment.