In btrfs_add_to_fsid(), strdup() allocates memory to device->name, but
the return value is not checked.
So add the return value check and error handling code.
And clean-up error handling code for ENOMEM case.
Signed-off-by: Byongho Lee <bhlee.ker...@gmail.com>
---
utils.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/utils.c b/utils.c
index 280637d896c1..160a8c273da8 100644
--- a/utils.c
+++ b/utils.c
@@ -729,21 +729,18 @@ int btrfs_add_to_fsid(struct btrfs_trans_handle *trans,
struct btrfs_super_block *super = root->fs_info->super_copy;
struct btrfs_device *device;
struct btrfs_dev_item *dev_item;
- char *buf;
+ char *buf = NULL;
u64 total_bytes;
u64 num_devs;
int ret;
device = kzalloc(sizeof(*device), GFP_NOFS);
if (!device)
- return -ENOMEM;
- buf = kmalloc(sectorsize, GFP_NOFS);
- if (!buf) {
- kfree(device);
- return -ENOMEM;
- }
+ goto err_nomem;
+ buf = kzalloc(sectorsize, GFP_NOFS);
+ if (!buf)
+ goto err_nomem;
BUG_ON(sizeof(*disk_super) > sectorsize);
- memset(buf, 0, sectorsize);
disk_super = (struct btrfs_super_block *)buf;
dev_item = &disk_super->dev_item;
@@ -761,6 +758,8 @@ int btrfs_add_to_fsid(struct btrfs_trans_handle *trans,
device->total_ios = 0;
device->dev_root = root->fs_info->dev_root;
device->name = strdup(path);
+ if (!device->name)
+ goto err_nomem;
ret = btrfs_add_device(trans, root, device);
BUG_ON(ret);
@@ -790,6 +789,11 @@ int btrfs_add_to_fsid(struct btrfs_trans_handle *trans,
list_add(&device->dev_list, &root->fs_info->fs_devices->devices);
device->fs_devices = root->fs_info->fs_devices;
return 0;
+
+err_nomem:
+ kfree(device);
+ kfree(buf);
+ return -ENOMEM;
}
static void btrfs_wipe_existing_sb(int fd)
--
2.5.0
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
