linux/drivers/infiniband
David Howells a95104fd33 Infiniband: Fix potential NULL d_inode dereference
Code that does this:

	if (!(d_unhashed(tmp) && tmp->d_inode)) {
		...
		simple_unlink(parent->d_inode, tmp);
	}

is broken because:

	!(d_unhashed(tmp) && tmp->d_inode)

is equivalent to:

	!d_unhashed(tmp) || !tmp->d_inode

so it is possible to get into simple_unlink() with tmp->d_inode == NULL.

simple_unlink(), however, assumes tmp->d_inode cannot be NULL.

I think that what was meant is this:

	!d_unhashed(tmp) && tmp->d_inode

and that the logical-not operator or the final close-bracket was misplaced.

Signed-off-by: David Howells <dhowells@redhat.com>
cc: Bryan O'Sullivan <bos@pathscale.com>
cc: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2015-02-20 04:56:45 -05:00
..
core Revert "IB/core: Add support for extended query device caps" 2015-02-06 00:54:33 -08:00
hw Infiniband: Fix potential NULL d_inode dereference 2015-02-20 04:56:45 -05:00
ulp Revert "IPoIB: Consolidate rtnl_lock tasks in workqueue" 2015-01-30 15:39:36 -08:00
Kconfig IB/core: Implement support for MMU notifiers regarding on demand paging regions 2014-12-15 18:13:36 -08:00
Makefile IB: Allow build of hw/ and ulp/ subdirectories independently 2014-06-02 14:51:12 -07:00