if (!S_ISREG(outentry.attr.mode)) 
if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid)) 
static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,			    struct nameidata *nd){	int err;	struct inode *inode;	struct fuse_conn *fc = get_fuse_conn(dir);	struct fuse_req *req;	struct fuse_open_in inarg;	struct fuse_open_out outopen;	struct fuse_entry_out outentry;	struct fuse_inode *fi;	struct fuse_file *ff;	struct file *file;	int flags = nd->intent.open.flags - 1;	err = -ENOSYS;	if (fc->no_create)		goto out;	err = -ENAMETOOLONG;	if (entry->d_name.len > FUSE_NAME_MAX)		goto out;	err = -EINTR;	req = fuse_get_request(fc);	if (!req)		goto out;	ff = fuse_file_alloc();	if (!ff)		goto out_put_request;	flags &= ~O_NOCTTY;	memset(&inarg, 0, sizeof(inarg));	inarg.flags = flags;	inarg.mode = mode;	req->in.h.opcode = FUSE_CREATE;	req->in.h.nodeid = get_node_id(dir);	req->inode = dir;	req->in.numargs = 2;	req->in.args[0].size = sizeof(inarg);	req->in.args[0].value = &inarg;	req->in.args[1].size = entry->d_name.len + 1;	req->in.args[1].value = entry->d_name.name;	req->out.numargs = 2;	req->out.args[0].size = sizeof(outentry);	req->out.args[0].value = &outentry;	req->out.args[1].size = sizeof(outopen);	req->out.args[1].value = &outopen;	request_send(fc, req);	err = req->out.h.error;	if (err) {		if (err == -ENOSYS)			fc->no_create = 1;		goto out_free_ff;	}	err = -EIO;	if (!S_ISREG(outentry.attr.mode))		goto out_free_ff;	inode = fuse_iget(dir->i_sb, outentry.nodeid, outentry.generation,			  &outentry.attr);	err = -ENOMEM;	if (!inode) {		flags &= ~(O_CREAT | O_EXCL | O_TRUNC);		ff->fh = outopen.fh;		fuse_send_release(fc, ff, outentry.nodeid, NULL, flags, 0);		goto out_put_request;	}	fuse_put_request(fc, req);	entry->d_time =	time_to_jiffies(outentry.entry_valid,					outentry.entry_valid_nsec);	fi = get_fuse_inode(inode);	fi->i_time = time_to_jiffies(outentry.attr_valid,				     outentry.attr_valid_nsec);	d_instantiate(entry, inode);	file = lookup_instantiate_filp(nd, entry, generic_file_open);	if (IS_ERR(file)) {		ff->fh = outopen.fh;		fuse_send_release(fc, ff, outentry.nodeid, inode, flags, 0);		return PTR_ERR(file);	}	fuse_finish_open(inode, file, ff, &outopen);	return 0; out_free_ff:	fuse_file_free(ff); out_put_request:	fuse_put_request(fc, req); out:	return err;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/2827d0b23b7279d0a717eea4029efeef2e1b0183/dir.c/buggy/fs/fuse/dir.c