summaryrefslogtreecommitdiff
path: root/fs/quota
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2010-10-19 00:24:21 +0200
committerJan Kara <jack@suse.cz>2010-10-28 01:30:06 +0200
commit4408ea41c0ab4b711d4da44dd954fb06dce6c3f8 (patch)
tree7244e8448303b034e17ab24a835012ae99b33734 /fs/quota
parenta4c18ad2eed93194a667cb9f6662c3b3e8f0bba9 (diff)
quota: Fix possible oops in __dquot_initialize()
When quotaon(8) races with __dquot_initialize() or dqget() fails because of EIO, ENOSPC, or similar error, we could possibly dereference NULL pointer in inode->i_dquot[cnt]. Add proper checking. Reported-by: Dmitry Monakhov <dmonakhov@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/quota')
-rw-r--r--fs/quota/dquot.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 1bc38f56fa7c..0fed41e6efcd 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1386,6 +1386,9 @@ static void __dquot_initialize(struct inode *inode, int type)
/* Avoid races with quotaoff() */
if (!sb_has_quota_active(sb, cnt))
continue;
+ /* We could race with quotaon or dqget() could have failed */
+ if (!got[cnt])
+ continue;
if (!inode->i_dquot[cnt]) {
inode->i_dquot[cnt] = got[cnt];
got[cnt] = NULL;