[Devel] [PATCH RHEL9 COMMIT] xfs: Check alloc_file() results in xfs_open_balloon()

[Konstantin Khorenko]

The commit is pushed to "branch-rh9-5.14.vz9.1.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh9-5.14.0-4.vz9.10.26
------>
commit 5f840d9c66b81de99c04740fa83ccbeeee459d0d
Author: Kirill Tkhai <ktkhai at virtuozzo.com>
Date:   Thu Oct 28 15:38:11 2021 +0000

    xfs: Check alloc_file() results in xfs_open_balloon()
    
    Check for pointer validity before its dereference.
    
    Reported-by: Alexander Mikhalitsyn <alexander.mikhalitsyn at virtuozzo.com>
    Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
---
 fs/xfs/xfs_ioctl.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 1282d9412f92..33fa33841201 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1940,7 +1940,7 @@ static int xfs_open_balloon(struct xfs_mount *mp, struct vfsmount *mnt)
 	u64 balloon_ino = READ_ONCE(mp->m_balloon_ino);
 	struct xfs_inode *ip;
 	struct inode *inode;
-	int err, fd;
+	int err, fd, ro;
 	struct file *filp;
 	struct dentry *de;
 	struct path path;
@@ -1965,13 +1965,13 @@ static int xfs_open_balloon(struct xfs_mount *mp, struct vfsmount *mnt)
 
 	path.dentry = de;
 	path.mnt = mntget(mnt);
-	err = mnt_want_write(path.mnt);
-	if (err)
+	ro = mnt_want_write(path.mnt);
+	if (ro)
 		mode = O_RDONLY;
 	else
 		mode = O_RDWR;
 	filp = alloc_file(&path, mode, &xfs_file_operations);
-	if (filp->f_mode & FMODE_WRITE)
+	if (!ro)
 		mnt_drop_write(path.mnt);
 	if (IS_ERR(filp)) {
 		err = PTR_ERR(filp);