Bug 24622

Summary: Memory allocation failure is not handled in fat_cache_add()
Product: File System Reporter: Eugene A. Shatokhin (eugene.shatokhin)
Component: FAT/VFAT/MSDOSAssignee: OGAWA Hirofumi (hirofumi)
Status: CLOSED CODE_FIX    
Severity: normal    
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 2.6.37-rc5 Subsystem:
Regression: No Bisected commit-id:

Description Eugene A. Shatokhin 2010-12-10 09:36:47 UTC 
The situation when memory allocation made in fat_cache_add() function fails is not handled (fs/fat/cache.c:153):

151: spin_unlock(&MSDOS_I(inode)->cache_lru_lock);
152: 
153: tmp = fat_cache_alloc(inode);
154: spin_lock(&MSDOS_I(inode)->cache_lru_lock); 

This may result in bad pointer dereference when executing 
'cache->fcluster = new->fcluster;' later (fs/fat/cache.c:166).

It seems, this problem is quite unlikely to occur in practice, it only showed up during fault simulation session performed by our tools, but still.
Comment 1 OGAWA Hirofumi 2011-05-25 09:12:05 UTC 
This will be fixed by 2.6.40. Thanks