Re: [PATCH] btrfs: fix dereference on inode->i_sb before inode null check
On 12/16/16 7:20 AM, Colin King wrote: > From: Colin Ian King > > inode is being deferenced and then inode is checked to see if it > is null, implying we potentially could have a null pointer deference > on inode. > > Found with static analysis by CoverityScan, CID 1389472 > > Fix this by dereferencing inode only after the inode null check. > > Fixes: 0b246afa62b0cf5 ("btrfs: root->fs_info cleanup, add fs_info > convenience variables") Hi Colin - Thanks for the review. The right fix here is to eliminate the tests for inode == NULL entirely. This is a callback for exportfs, which will itself crash if dentry->d_inode or parent->d_inode is NULL. Removing the tests would be consistent with other file systems. -Jeff > Signed-off-by: Colin Ian King > --- > fs/btrfs/export.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c > index 340d907..b746d2b 100644 > --- a/fs/btrfs/export.c > +++ b/fs/btrfs/export.c > @@ -223,7 +223,7 @@ static int btrfs_get_name(struct dentry *parent, char > *name, > { > struct inode *inode = d_inode(child); > struct inode *dir = d_inode(parent); > - struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); > + struct btrfs_fs_info *fs_info; > struct btrfs_path *path; > struct btrfs_root *root = BTRFS_I(dir)->root; > struct btrfs_inode_ref *iref; > @@ -241,6 +241,7 @@ static int btrfs_get_name(struct dentry *parent, char > *name, > if (!S_ISDIR(dir->i_mode)) > return -EINVAL; > > + fs_info = btrfs_sb(inode->i_sb); > ino = btrfs_ino(inode); > > path = btrfs_alloc_path(); > -- Jeff Mahoney SUSE Labs signature.asc Description: OpenPGP digital signature
Re: [PATCH] btrfs: fix dereference on inode->i_sb before inode null check
On 16/12/16 15:03, Jeff Mahoney wrote: > On 12/16/16 7:20 AM, Colin King wrote: >> From: Colin Ian King >> >> inode is being deferenced and then inode is checked to see if it >> is null, implying we potentially could have a null pointer deference >> on inode. >> >> Found with static analysis by CoverityScan, CID 1389472 >> >> Fix this by dereferencing inode only after the inode null check. >> >> Fixes: 0b246afa62b0cf5 ("btrfs: root->fs_info cleanup, add fs_info >> convenience variables") > > Hi Colin - > > Thanks for the review. The right fix here is to eliminate the tests for > inode == NULL entirely. This is a callback for exportfs, which will > itself crash if dentry->d_inode or parent->d_inode is NULL. Removing > the tests would be consistent with other file systems. Ah, thanks for pointing that out. New patch on it's way soon. Colin > > -Jeff > >> Signed-off-by: Colin Ian King >> --- >> fs/btrfs/export.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c >> index 340d907..b746d2b 100644 >> --- a/fs/btrfs/export.c >> +++ b/fs/btrfs/export.c >> @@ -223,7 +223,7 @@ static int btrfs_get_name(struct dentry *parent, char >> *name, >> { >> struct inode *inode = d_inode(child); >> struct inode *dir = d_inode(parent); >> -struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); >> +struct btrfs_fs_info *fs_info; >> struct btrfs_path *path; >> struct btrfs_root *root = BTRFS_I(dir)->root; >> struct btrfs_inode_ref *iref; >> @@ -241,6 +241,7 @@ static int btrfs_get_name(struct dentry *parent, char >> *name, >> if (!S_ISDIR(dir->i_mode)) >> return -EINVAL; >> >> +fs_info = btrfs_sb(inode->i_sb); >> ino = btrfs_ino(inode); >> >> path = btrfs_alloc_path(); >> > > signature.asc Description: OpenPGP digital signature
[PATCH] btrfs: fix dereference on inode->i_sb before inode null check
From: Colin Ian King inode is being deferenced and then inode is checked to see if it is null, implying we potentially could have a null pointer deference on inode. Found with static analysis by CoverityScan, CID 1389472 Fix this by dereferencing inode only after the inode null check. Fixes: 0b246afa62b0cf5 ("btrfs: root->fs_info cleanup, add fs_info convenience variables") Signed-off-by: Colin Ian King --- fs/btrfs/export.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c index 340d907..b746d2b 100644 --- a/fs/btrfs/export.c +++ b/fs/btrfs/export.c @@ -223,7 +223,7 @@ static int btrfs_get_name(struct dentry *parent, char *name, { struct inode *inode = d_inode(child); struct inode *dir = d_inode(parent); - struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_fs_info *fs_info; struct btrfs_path *path; struct btrfs_root *root = BTRFS_I(dir)->root; struct btrfs_inode_ref *iref; @@ -241,6 +241,7 @@ static int btrfs_get_name(struct dentry *parent, char *name, if (!S_ISDIR(dir->i_mode)) return -EINVAL; + fs_info = btrfs_sb(inode->i_sb); ino = btrfs_ino(inode); path = btrfs_alloc_path(); -- 2.10.2 -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html