linux-kernel - [PATCH][next] afs: fix a dereference on pointer cell before cell is null checked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Oct 2020 14:11:33 +0100
From:   Colin King <colin.king@...onical.com>
To:     David Howells <dhowells@...hat.com>, linux-afs@...ts.infradead.org
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH][next] afs: fix a dereference on pointer cell before cell is null checked

From: Colin Ian King <colin.king@...onical.com>

Currently the assignment of debug_id dereferences pointer cell before
cell has been null checked.  Fix this by removing debug_id and use
cell->debug_id after cell has been null checked.

Addresses-Coverity: ("Dereference before null check")
Fixes: dca54a7bbb8c ("afs: Add tracing for cell refcount and active user count")
Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 fs/afs/cell.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/afs/cell.c b/fs/afs/cell.c
index 52233fa6195f..4449ff100a3c 100644
--- a/fs/afs/cell.c
+++ b/fs/afs/cell.c
@@ -589,7 +589,6 @@ struct afs_cell *afs_use_cell(struct afs_cell *cell, enum afs_cell_trace reason)
  */
 void afs_unuse_cell(struct afs_net *net, struct afs_cell *cell, enum afs_cell_trace reason)
 {
-	unsigned int debug_id = cell->debug_id;
 	time64_t now, expire_delay;
 	int u, a;
 
@@ -606,7 +605,7 @@ void afs_unuse_cell(struct afs_net *net, struct afs_cell *cell, enum afs_cell_tr
 
 	u = atomic_read(&cell->ref);
 	a = atomic_dec_return(&cell->active);
-	trace_afs_cell(debug_id, u, a, reason);
+	trace_afs_cell(cell->debug_id, u, a, reason);
 	WARN_ON(a == 0);
 	if (a == 1)
 		/* 'cell' may now be garbage collected. */
-- 
2.27.0