The situation when memory allocation made in fat_cache_add() function fails is not handled (fs/fat/cache.c:153):
153: tmp = fat_cache_alloc(inode);
This may result in bad pointer dereference when executing
'cache->fcluster = new->fcluster;' later (fs/fat/cache.c:166).
It seems, this problem is quite unlikely to occur in practice, it only showed up during fault simulation session performed by our tools, but still.
This will be fixed by 2.6.40. Thanks