Commit 47ba9734 authored by Dan Carpenter's avatar Dan Carpenter Committed by Steven Whitehouse

fs: NULL dereference in posix_acl_to_xattr()

This patch moves the dereference of "buffer" after the check for NULL.
The only place which passes a NULL parameter is gfs2_set_acl().

Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarSteven Whitehouse <swhiteho@redhat.com>
parent 022ef4fe
...@@ -717,7 +717,7 @@ posix_acl_to_xattr(struct user_namespace *user_ns, const struct posix_acl *acl, ...@@ -717,7 +717,7 @@ posix_acl_to_xattr(struct user_namespace *user_ns, const struct posix_acl *acl,
void *buffer, size_t size) void *buffer, size_t size)
{ {
posix_acl_xattr_header *ext_acl = (posix_acl_xattr_header *)buffer; posix_acl_xattr_header *ext_acl = (posix_acl_xattr_header *)buffer;
posix_acl_xattr_entry *ext_entry = ext_acl->a_entries; posix_acl_xattr_entry *ext_entry;
int real_size, n; int real_size, n;
real_size = posix_acl_xattr_size(acl->a_count); real_size = posix_acl_xattr_size(acl->a_count);
...@@ -725,7 +725,8 @@ posix_acl_to_xattr(struct user_namespace *user_ns, const struct posix_acl *acl, ...@@ -725,7 +725,8 @@ posix_acl_to_xattr(struct user_namespace *user_ns, const struct posix_acl *acl,
return real_size; return real_size;
if (real_size > size) if (real_size > size)
return -ERANGE; return -ERANGE;
ext_entry = ext_acl->a_entries;
ext_acl->a_version = cpu_to_le32(POSIX_ACL_XATTR_VERSION); ext_acl->a_version = cpu_to_le32(POSIX_ACL_XATTR_VERSION);
for (n=0; n < acl->a_count; n++, ext_entry++) { for (n=0; n < acl->a_count; n++, ext_entry++) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment