From nobody Mon Apr 13 18:37:03 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7F22C4332F for ; Fri, 18 Nov 2022 11:41:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241490AbiKRLlo (ORCPT ); Fri, 18 Nov 2022 06:41:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43338 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241100AbiKRLlk (ORCPT ); Fri, 18 Nov 2022 06:41:40 -0500 Received: from mx.swemel.ru (mx.swemel.ru [95.143.211.150]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CA5E717430; Fri, 18 Nov 2022 03:41:39 -0800 (PST) From: Denis Arefev DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=swemel.ru; s=mail; t=1668771697; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=SSD/8D3oxjxNO6XFSWDffwRmka85Uk/caIyP96y7PQk=; b=cl/J/kReOmnmtGqxIEY9x/uDHsYTje/wJhEd5YDc6K8CwBGEj6LD9pzQZbOjoQCGEsGRWi f7IiCj8XHMiEEILyZt+68o7mpukiEW3cdmLUUyrAGKQ+J0spkkstvwBxUXB1ayhgGbXcWd wJKEmJcdgQMEgL1iCzw6hT+PZh41Gd4= To: Alexander Viro Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, trufanov@swemel.ru, vfh@swemel.ru Subject: [PATCH v2] namespace: Added pointer check in copy_mnt_ns() Date: Fri, 18 Nov 2022 14:41:37 +0300 Message-Id: <20221118114137.128088-1-arefev@swemel.ru> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Return value of a function 'next_mnt' is dereferenced at namespace.c:3377 without checking for null, but it is usually checked for this function Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Denis Arefev --- fs/namespace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index cebaa3e81794..06472a110257 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -3348,9 +3348,9 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags= , struct mnt_namespace *ns, } p =3D next_mnt(p, old); q =3D next_mnt(q, new); - if (!q) + if (!q || !p) break; - while (p->mnt.mnt_root !=3D q->mnt.mnt_root) + while (p && (p->mnt.mnt_root !=3D q->mnt.mnt_root)) p =3D next_mnt(p, old); } namespace_unlock(); --=20 2.25.1