[rtems commit] PR2039: Fix NULL pointer access

[Sebastian Huber]

Module:    rtems
Branch:    4.10
Commit:    f38caffa62c23ac04c2b88416dfe346b7ed81a9a
Changeset: http://git.rtems.org/rtems/commit/?id=f38caffa62c23ac04c2b88416dfe346b7ed81a9a

Author:    Sebastian Huber <sebastian.huber at embedded-brains.de>
Date:      Fri Mar  9 14:13:22 2012 +0100

PR2039: Fix NULL pointer access

In case rtems_bdbuf_read() returns an error status, the block device
buffer pointer will be set to NULL.  In RFS the chain node of the block
device buffer will be used for RFS purposes.  We must not do this after
an erroneous read.

---

 cpukit/libfs/src/rfs/rtems-rfs-buffer.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpukit/libfs/src/rfs/rtems-rfs-buffer.c b/cpukit/libfs/src/rfs/rtems-rfs-buffer.c
index 43fb586..6c8ad82 100644
--- a/cpukit/libfs/src/rfs/rtems-rfs-buffer.c
+++ b/cpukit/libfs/src/rfs/rtems-rfs-buffer.c
@@ -166,8 +166,6 @@ rtems_rfs_buffer_handle_request (rtems_rfs_file_system*   fs,
   {
     rc = rtems_rfs_buffer_io_request (fs, block, read, &handle->buffer);
 
-    rtems_chain_set_off_chain (rtems_rfs_buffer_link(handle));
-
     if (rc > 0)
     {
       if (rtems_rfs_trace (RTEMS_RFS_TRACE_BUFFER_HANDLE_REQUEST))
@@ -175,6 +173,8 @@ rtems_rfs_buffer_handle_request (rtems_rfs_file_system*   fs,
                 block, read ? "read" : "get", rc, strerror (rc));
       return rc;
     }
+
+    rtems_chain_set_off_chain (rtems_rfs_buffer_link(handle));
   }
 
   /*