From patchwork Tue Sep 20 06:48:27 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: shailendra.v@samsung.com X-Patchwork-Id: 9341103 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 178D5601C2 for ; Tue, 20 Sep 2016 06:49:13 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0818429C5C for ; Tue, 20 Sep 2016 06:49:13 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EF08329C5F; Tue, 20 Sep 2016 06:49:12 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7102429C5C for ; Tue, 20 Sep 2016 06:49:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752163AbcITGsx (ORCPT ); Tue, 20 Sep 2016 02:48:53 -0400 Received: from mailout2.samsung.com ([203.254.224.25]:32791 "EHLO mailout2.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751146AbcITGsv (ORCPT ); Tue, 20 Sep 2016 02:48:51 -0400 Received: from epcpsbgm2new.samsung.com (epcpsbgm2 [203.254.230.27]) by mailout2.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0ODS01L25IXCOE60@mailout2.samsung.com>; Tue, 20 Sep 2016 15:48:48 +0900 (KST) X-AuditID: cbfee61b-f79466d000001e3c-ce-57e0dbd011f4 Received: from epmmp1.local.host ( [203.254.227.16]) by epcpsbgm2new.samsung.com (EPCPMTA) with SMTP id EF.5A.07740.0DBD0E75; Mon, 19 Sep 2016 23:48:48 -0700 (MST) Received: from srin.p4 ([107.108.168.37]) by mmp1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0ODS0089AIWRTR30@mmp1.samsung.com>; Tue, 20 Sep 2016 15:48:48 +0900 (KST) From: Shailendra Verma To: Chris Mason , Josef Bacik , David Sterba , linux-btrfs@vger.kernel.org, Shailendra Verma , Ravikant Sharma Cc: linux-kernel@vger.kernel.org, vidushi.koul@samsung.com Subject: Fs: Btrfs - Fix possible ERR_PTR() dereferencing. Date: Tue, 20 Sep 2016 12:18:27 +0530 Message-id: <1474354107-18774-1-git-send-email-shailendra.v@samsung.com> X-Mailer: git-send-email 1.7.9.5 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrHJMWRmVeSWpSXmKPExsVy+t9jAd0Ltx+EG8zeamkxqX8Gu8WFH41M Fn93LmSxuPR4BbvF5V1z2CyaGmazWyz69orZ4u/FS2wOHB4Tm9+xe/RtWcXosX7LVRaPz5vk AliiuGxSUnMyy1KL9O0SuDI2n25gL/jPXXGw/ytrA+MZzi5GTg4JAROJc9eWskDYYhIX7q1n 62Lk4hASWMooMWclSALEec0oMaVhLxNIFZuAocTrvr9gtojAVUaJ/unRIDazgJXEpP+zWUFs YSB7xszfjCA2i4CqxMLJd9lBbF4BD4lJBy4B1XAAbVOQmDPJZgIj9wJGhlWMEqkFyQXFSem5 Rnmp5XrFibnFpXnpesn5uZsYwaHyTHoH4+Fd7ocYBTgYlXh4Ax7eDxdiTSwrrsw9xCjBwawk wmty/UG4EG9KYmVValF+fFFpTmrxIUZpDhYlcd7H/9eFCQmkJ5akZqemFqQWwWSZODilGhjX dzCdj5aJ6ruV9Pf/sqonF6IEd+25IHfmTSpD+I17dQ1zFlny77l9/bAg03Plk1ypD1TNXihm rhDyDmnOvRj4Jz10zWbVto51D2u3zDa4E6BqJilcfP7AJAe+p/MD5//UtH58wuvqI24PterK Wal3zh2v0+Y+0fVHNDVjb0n3+ePsO2s+M+oqsRRnJBpqMRcVJwIAU70OORECAAA= Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This is of course wrong to call kfree() if memdup_user() fails, no memory was allocated and the error in the error-valued pointer should be returned. Reviewed-by: Ravikant Sharma Signed-off-by: Shailendra Verma --- fs/btrfs/ioctl.c | 21 ++++++--------------- 1 file changed, 6 insertions(+), 15 deletions(-) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index da94138..58a40f8 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -4512,11 +4512,8 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_root *root, return -EPERM; loi = memdup_user(arg, sizeof(*loi)); - if (IS_ERR(loi)) { - ret = PTR_ERR(loi); - loi = NULL; - goto out; - } + if (IS_ERR(loi)) + return PTR_ERR(loi); path = btrfs_alloc_path(); if (!path) { @@ -5143,11 +5140,8 @@ static long btrfs_ioctl_set_received_subvol_32(struct file *file, int ret = 0; args32 = memdup_user(arg, sizeof(*args32)); - if (IS_ERR(args32)) { - ret = PTR_ERR(args32); - args32 = NULL; - goto out; - } + if (IS_ERR(args32)) + return PTR_ERR(args32); args64 = kmalloc(sizeof(*args64), GFP_NOFS); if (!args64) { @@ -5195,11 +5189,8 @@ static long btrfs_ioctl_set_received_subvol(struct file *file, int ret = 0; sa = memdup_user(arg, sizeof(*sa)); - if (IS_ERR(sa)) { - ret = PTR_ERR(sa); - sa = NULL; - goto out; - } + if (IS_ERR(sa)) + return PTR_ERR(sa); ret = _btrfs_ioctl_set_received_subvol(file, sa);