quota: Fix possible oops in __dquot_initialize()
authorJan Kara <jack@suse.cz>
Mon, 18 Oct 2010 22:24:21 +0000 (00:24 +0200)
committerJan Kara <jack@suse.cz>
Wed, 27 Oct 2010 23:30:06 +0000 (01:30 +0200)
When quotaon(8) races with __dquot_initialize() or dqget() fails because
of EIO, ENOSPC, or similar error, we could possibly dereference NULL pointer
in inode->i_dquot[cnt]. Add proper checking.

Reported-by: Dmitry Monakhov <dmonakhov@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
fs/quota/dquot.c

index 1bc38f56fa7c70b39c482da61808cbc47894e9b6..0fed41e6efcda6e993d83fe9bbb6da970ff4bd4b 100644 (file)
@@ -1386,6 +1386,9 @@ static void __dquot_initialize(struct inode *inode, int type)
                /* Avoid races with quotaoff() */
                if (!sb_has_quota_active(sb, cnt))
                        continue;
+               /* We could race with quotaon or dqget() could have failed */
+               if (!got[cnt])
+                       continue;
                if (!inode->i_dquot[cnt]) {
                        inode->i_dquot[cnt] = got[cnt];
                        got[cnt] = NULL;