Showing error 1747

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: fs/affs/file.c
Line in file: 893
Project: Linux Kernel
Project version: 2.6.28
Confirmation: Fixed by 0e45b67d5aeb3dcfb6b149cf61c30b9a8e503f74
Tools: Smatch (1.59)
Entered: 2013-09-10 20:24:52 UTC

Source: 

863        blk = last_blk;
864        if (inode->i_size) {
865                i = last_blk % AFFS_SB(sb)->s_hashsize + 1;
866                blk++;
867        } else
868                AFFS_HEAD(ext_bh)->first_data = 0;
869        AFFS_HEAD(ext_bh)->block_count = cpu_to_be32(i);
870        size = AFFS_SB(sb)->s_hashsize;
871        if (size > blkcnt - blk + i)
872                size = blkcnt - blk + i;
873        for (; i < size; i++, blk++) {
874                affs_free_block(sb, be32_to_cpu(AFFS_BLOCK(sb, ext_bh, i)));
875                AFFS_BLOCK(sb, ext_bh, i) = 0;
876        }
877        AFFS_TAIL(sb, ext_bh)->extension = 0;
878        affs_fix_checksum(sb, ext_bh);
879        mark_buffer_dirty_inode(ext_bh, inode);
880        affs_brelse(ext_bh);
881
882        if (inode->i_size) {
883                AFFS_I(inode)->i_blkcnt = last_blk + 1;
884                AFFS_I(inode)->i_extcnt = ext + 1;
885                if (AFFS_SB(sb)->s_flags & SF_OFS) {
886                        struct buffer_head *bh = affs_bread_ino(inode, last_blk, 0);
887                        u32 tmp;
888                        if (IS_ERR(ext_bh)) {
889                                affs_warning(sb, "truncate", "unexpected read error for last block %u (%d)",
890                                             ext, PTR_ERR(ext_bh));
891                                return;
892                        }
893                        tmp = be32_to_cpu(AFFS_DATA_HEAD(bh)->next);
894                        AFFS_DATA_HEAD(bh)->next = 0;
895                        affs_adjust_checksum(bh, -tmp);
896                        affs_brelse(bh);
897                }
898        } else {
899                AFFS_I(inode)->i_blkcnt = 0;
900                AFFS_I(inode)->i_extcnt = 1;
901        }
902        AFFS_I(inode)->mmu_private = inode->i_size;
903        // unlock cache
Show full sources
↑