diff options
author | Dan Carpenter <error27@gmail.com> | 2009-02-15 20:02:19 -0500 |
---|---|---|
committer | Theodore Ts'o <tytso@mit.edu> | 2009-02-15 20:02:19 -0500 |
commit | 090542641de833c6f756895fc2f139f046e298f9 (patch) | |
tree | 8a3939e4e72e5107282a5343d2cb50c29e5077a6 /fs/ext4/migrate.c | |
parent | 2acf2c261b823d9d9ed954f348b97620297a36b5 (diff) |
ext4: Fix NULL dereference in ext4_ext_migrate()'s error handling
This was found through a code checker (http://repo.or.cz/w/smatch.git/).
It looks like you might be able to trigger the error by trying to migrate
a readonly file system.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Diffstat (limited to 'fs/ext4/migrate.c')
-rw-r--r-- | fs/ext4/migrate.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c index 734abca25e35..fe64d9f79852 100644 --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c | |||
@@ -481,7 +481,7 @@ int ext4_ext_migrate(struct inode *inode) | |||
481 | + 1); | 481 | + 1); |
482 | if (IS_ERR(handle)) { | 482 | if (IS_ERR(handle)) { |
483 | retval = PTR_ERR(handle); | 483 | retval = PTR_ERR(handle); |
484 | goto err_out; | 484 | return retval; |
485 | } | 485 | } |
486 | tmp_inode = ext4_new_inode(handle, | 486 | tmp_inode = ext4_new_inode(handle, |
487 | inode->i_sb->s_root->d_inode, | 487 | inode->i_sb->s_root->d_inode, |
@@ -489,8 +489,7 @@ int ext4_ext_migrate(struct inode *inode) | |||
489 | if (IS_ERR(tmp_inode)) { | 489 | if (IS_ERR(tmp_inode)) { |
490 | retval = -ENOMEM; | 490 | retval = -ENOMEM; |
491 | ext4_journal_stop(handle); | 491 | ext4_journal_stop(handle); |
492 | tmp_inode = NULL; | 492 | return retval; |
493 | goto err_out; | ||
494 | } | 493 | } |
495 | i_size_write(tmp_inode, i_size_read(inode)); | 494 | i_size_write(tmp_inode, i_size_read(inode)); |
496 | /* | 495 | /* |
@@ -618,8 +617,7 @@ err_out: | |||
618 | 617 | ||
619 | ext4_journal_stop(handle); | 618 | ext4_journal_stop(handle); |
620 | 619 | ||
621 | if (tmp_inode) | 620 | iput(tmp_inode); |
622 | iput(tmp_inode); | ||
623 | 621 | ||
624 | return retval; | 622 | return retval; |
625 | } | 623 | } |