forked from luck/tmp_suning_uos_patched
7074e5eb23
If list_for_each_entry, etc complete a traversal of the list, the iterator variable ends up pointing to an address at an offset from the list head, and not a meaningful structure. Thus this value should not be used after the end of the iterator. Replace a field access from orphan by NULL in two places. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ identifier c; expression E; iterator name list_for_each_entry; statement S; @@ list_for_each_entry(c,...) { ... when != break; when forall when strict } ... ( c = E | *c ) // </smpl> Artem: fortunately, this did not cause any issues because we iterate the orphan list using the elements count, so we never dereferenced the corrupted pointer. This is why I do not send this patch to -stable. But otherwise - well spotted! Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com> |
||
|---|---|---|
| .. | ||
| budget.c | ||
| commit.c | ||
| compress.c | ||
| debug.c | ||
| debug.h | ||
| dir.c | ||
| file.c | ||
| find.c | ||
| gc.c | ||
| io.c | ||
| ioctl.c | ||
| journal.c | ||
| Kconfig | ||
| key.h | ||
| log.c | ||
| lprops.c | ||
| lpt_commit.c | ||
| lpt.c | ||
| Makefile | ||
| master.c | ||
| misc.h | ||
| orphan.c | ||
| recovery.c | ||
| replay.c | ||
| sb.c | ||
| scan.c | ||
| shrinker.c | ||
| super.c | ||
| tnc_commit.c | ||
| tnc_misc.c | ||
| tnc.c | ||
| ubifs-media.h | ||
| ubifs.h | ||
| xattr.c | ||