leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Btrfs: kfree()ing ERR_PTRs

Browse Source 
The "inherit" in btrfs_ioctl_snap_create_v2() and "vol_args" in
btrfs_ioctl_rm_dev() are ERR_PTRs so we can't call kfree() on them.

These kind of bugs are "One Err Bugs" where there is just one error
label that does everything.  I could set the "inherit = NULL" and keep
the single out label but it ends up being more complicated that way.  It
makes the code simpler to re-order the unwind so it's in the mirror
order of the allocation and introduce some new error labels.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Chris Mason <clm@fb.com>
This commit is contained in:
Dan Carpenter 2014-09-04 14:09:15 +03:00 committed by Chris Mason
parent dac5705cad
commit c47ca32d3a
1 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
fs/btrfs/ioctl.c
View File

@ -1703,7 +1703,7 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file,
~(BTRFS_SUBVOL_CREATE_ASYNC | BTRFS_SUBVOL_RDONLY | ~(BTRFS_SUBVOL_CREATE_ASYNC | BTRFS_SUBVOL_RDONLY |
BTRFS_SUBVOL_QGROUP_INHERIT)) { BTRFS_SUBVOL_QGROUP_INHERIT)) {
ret = -EOPNOTSUPP; ret = -EOPNOTSUPP;
goto out; goto free_args;
} }
if (vol_args->flags & BTRFS_SUBVOL_CREATE_ASYNC) if (vol_args->flags & BTRFS_SUBVOL_CREATE_ASYNC)
@ -1713,27 +1713,31 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file,
if (vol_args->flags & BTRFS_SUBVOL_QGROUP_INHERIT) { if (vol_args->flags & BTRFS_SUBVOL_QGROUP_INHERIT) {
if (vol_args->size > PAGE_CACHE_SIZE) { if (vol_args->size > PAGE_CACHE_SIZE) {
ret = -EINVAL; ret = -EINVAL;
goto out; goto free_args;
} }
inherit = memdup_user(vol_args->qgroup_inherit, vol_args->size); inherit = memdup_user(vol_args->qgroup_inherit, vol_args->size);
if (IS_ERR(inherit)) { if (IS_ERR(inherit)) {
ret = PTR_ERR(inherit); ret = PTR_ERR(inherit);
goto out; goto free_args;
} }
} }
ret = btrfs_ioctl_snap_create_transid(file, vol_args->name, ret = btrfs_ioctl_snap_create_transid(file, vol_args->name,
vol_args->fd, subvol, ptr, vol_args->fd, subvol, ptr,
readonly, inherit); readonly, inherit);
if (ret)
goto free_inherit;
if (ret == 0 && ptr && if (ptr && copy_to_user(arg +
copy_to_user(arg + offsetof(struct btrfs_ioctl_vol_args_v2,
offsetof(struct btrfs_ioctl_vol_args_v2, transid),
transid), ptr, sizeof(*ptr))) ptr, sizeof(*ptr)))
ret = -EFAULT; ret = -EFAULT;
out:
kfree(vol_args); free_inherit:
kfree(inherit); kfree(inherit);
free_args:
kfree(vol_args);
return ret; return ret;
} }
@ -2653,7 +2657,7 @@ static long btrfs_ioctl_rm_dev(struct file *file, void __user *arg)
vol_args = memdup_user(arg, sizeof(*vol_args)); vol_args = memdup_user(arg, sizeof(*vol_args));
if (IS_ERR(vol_args)) { if (IS_ERR(vol_args)) {
ret = PTR_ERR(vol_args); ret = PTR_ERR(vol_args);
goto out; goto err_drop;
} }
vol_args->name[BTRFS_PATH_NAME_MAX] = '\0'; vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
@ -2671,6 +2675,7 @@ static long btrfs_ioctl_rm_dev(struct file *file, void __user *arg)
out: out:
kfree(vol_args); kfree(vol_args);
err_drop:
mnt_drop_write_file(file); mnt_drop_write_file(file);
return ret; return ret;
} }