[Devel] [PATCH RH9 v2 2/2] xfs: Check alloc_file() results in xfs_open_balloon()

[Kirill Tkhai]

Check for pointer validity before its dereference.

Reported-by: Alexander Mikhalitsyn <alexander.mikhalitsyn at virtuozzo.com>
Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
---
 fs/xfs/xfs_ioctl.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 1282d9412f92..33fa33841201 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1940,7 +1940,7 @@ static int xfs_open_balloon(struct xfs_mount *mp, struct vfsmount *mnt)
 	u64 balloon_ino = READ_ONCE(mp->m_balloon_ino);
 	struct xfs_inode *ip;
 	struct inode *inode;
-	int err, fd;
+	int err, fd, ro;
 	struct file *filp;
 	struct dentry *de;
 	struct path path;
@@ -1965,13 +1965,13 @@ static int xfs_open_balloon(struct xfs_mount *mp, struct vfsmount *mnt)
 
 	path.dentry = de;
 	path.mnt = mntget(mnt);
-	err = mnt_want_write(path.mnt);
-	if (err)
+	ro = mnt_want_write(path.mnt);
+	if (ro)
 		mode = O_RDONLY;
 	else
 		mode = O_RDWR;
 	filp = alloc_file(&path, mode, &xfs_file_operations);
-	if (filp->f_mode & FMODE_WRITE)
+	if (!ro)
 		mnt_drop_write(path.mnt);
 	if (IS_ERR(filp)) {
 		err = PTR_ERR(filp);