| Message ID | 20161216122056.20607-1-colin.king@canonical.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
On 12/16/16 7:20 AM, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > inode is being deferenced and then inode is checked to see if it > is null, implying we potentially could have a null pointer deference > on inode. > > Found with static analysis by CoverityScan, CID 1389472 > > Fix this by dereferencing inode only after the inode null check. > > Fixes: 0b246afa62b0cf5 ("btrfs: root->fs_info cleanup, add fs_info convenience variables") Hi Colin - Thanks for the review. The right fix here is to eliminate the tests for inode == NULL entirely. This is a callback for exportfs, which will itself crash if dentry->d_inode or parent->d_inode is NULL. Removing the tests would be consistent with other file systems. -Jeff > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > fs/btrfs/export.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c > index 340d907..b746d2b 100644 > --- a/fs/btrfs/export.c > +++ b/fs/btrfs/export.c > @@ -223,7 +223,7 @@ static int btrfs_get_name(struct dentry *parent, char *name, > { > struct inode *inode = d_inode(child); > struct inode *dir = d_inode(parent); > - struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); > + struct btrfs_fs_info *fs_info; > struct btrfs_path *path; > struct btrfs_root *root = BTRFS_I(dir)->root; > struct btrfs_inode_ref *iref; > @@ -241,6 +241,7 @@ static int btrfs_get_name(struct dentry *parent, char *name, > if (!S_ISDIR(dir->i_mode)) > return -EINVAL; > > + fs_info = btrfs_sb(inode->i_sb); > ino = btrfs_ino(inode); > > path = btrfs_alloc_path(); >
On 16/12/16 15:03, Jeff Mahoney wrote: > On 12/16/16 7:20 AM, Colin King wrote: >> From: Colin Ian King <colin.king@canonical.com> >> >> inode is being deferenced and then inode is checked to see if it >> is null, implying we potentially could have a null pointer deference >> on inode. >> >> Found with static analysis by CoverityScan, CID 1389472 >> >> Fix this by dereferencing inode only after the inode null check. >> >> Fixes: 0b246afa62b0cf5 ("btrfs: root->fs_info cleanup, add fs_info convenience variables") > > Hi Colin - > > Thanks for the review. The right fix here is to eliminate the tests for > inode == NULL entirely. This is a callback for exportfs, which will > itself crash if dentry->d_inode or parent->d_inode is NULL. Removing > the tests would be consistent with other file systems. Ah, thanks for pointing that out. New patch on it's way soon. Colin > > -Jeff > >> Signed-off-by: Colin Ian King <colin.king@canonical.com> >> --- >> fs/btrfs/export.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c >> index 340d907..b746d2b 100644 >> --- a/fs/btrfs/export.c >> +++ b/fs/btrfs/export.c >> @@ -223,7 +223,7 @@ static int btrfs_get_name(struct dentry *parent, char *name, >> { >> struct inode *inode = d_inode(child); >> struct inode *dir = d_inode(parent); >> - struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); >> + struct btrfs_fs_info *fs_info; >> struct btrfs_path *path; >> struct btrfs_root *root = BTRFS_I(dir)->root; >> struct btrfs_inode_ref *iref; >> @@ -241,6 +241,7 @@ static int btrfs_get_name(struct dentry *parent, char *name, >> if (!S_ISDIR(dir->i_mode)) >> return -EINVAL; >> >> + fs_info = btrfs_sb(inode->i_sb); >> ino = btrfs_ino(inode); >> >> path = btrfs_alloc_path(); >> > >
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c index 340d907..b746d2b 100644 --- a/fs/btrfs/export.c +++ b/fs/btrfs/export.c @@ -223,7 +223,7 @@ static int btrfs_get_name(struct dentry *parent, char *name, { struct inode *inode = d_inode(child); struct inode *dir = d_inode(parent); - struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_fs_info *fs_info; struct btrfs_path *path; struct btrfs_root *root = BTRFS_I(dir)->root; struct btrfs_inode_ref *iref; @@ -241,6 +241,7 @@ static int btrfs_get_name(struct dentry *parent, char *name, if (!S_ISDIR(dir->i_mode)) return -EINVAL; + fs_info = btrfs_sb(inode->i_sb); ino = btrfs_ino(inode); path = btrfs_alloc_path();