From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id AD1A6C001DF for ; Tue, 1 Aug 2023 09:05:24 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 6115786BB1; Tue, 1 Aug 2023 11:05:22 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=kernel.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.b="uEs1HxIp"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 79DEC86BB8; Tue, 1 Aug 2023 11:05:21 +0200 (CEST) Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 4700286B5A for ; Tue, 1 Aug 2023 11:05:19 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=kernel.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=kabel@kernel.org Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DBAEB614D2; Tue, 1 Aug 2023 09:05:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82534C433C7; Tue, 1 Aug 2023 09:05:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1690880716; bh=soTEWGEYBayWWxElMy5fvimbsFYls0Pe2trKOTVfxQE=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=uEs1HxIpVuDyoTmvKrSzW335qEnmeyLXmdNrFufji2QK7TusztXdgpODYZMyovfU1 77azrSDe2LKqvZ7Ms5JGLvGss37ravw1k6h7WsmeiYoeK3VkO4Zjl3HjjaNlCqYR57 kuQLQZKRHIGBnZnnsh/SRJ6Rw4298XOr1jNr9SAc1Y4Ibe1qug23F0pzxFIxavnrjd VpjGVzkwGOqI3M3TB8K3WMEnSnE0cUUeZipcv8kYwfdgVMvINX3AgtEAbXQCIHMv22 d+uWfWOMA9We8VNqjwtToLE1gBCSntaA8MKd5mSbgyfbY9W7O9pH+PkqxakkGZe5iA swnqf/hz6GxZg== Date: Tue, 1 Aug 2023 11:05:11 +0200 From: Marek =?UTF-8?B?QmVow7pu?= To: Dan Carpenter Cc: Qu Wenruo , u-boot@lists.denx.de Subject: Re: [PATCH] fs: btrfs: Prevent error pointer dereference in list_subvolums() Message-ID: <20230801110355.6ec692e5@dellmb> In-Reply-To: <35c4ef18-f928-47c2-9661-17641aed124a@moroto.mountain> References: <35c4ef18-f928-47c2-9661-17641aed124a@moroto.mountain> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean On Wed, 26 Jul 2023 09:59:04 +0300 Dan Carpenter wrote: > If btrfs_read_fs_root() fails with -ENOENT, then we go to the next > entry. Fine. But if it fails for a different reason then we need > to clean up and return an error code. In the current code it > doesn't clean up but instead dereferences "root" and crashes. >=20 > Signed-off-by: Dan Carpenter > --- > I didn't CC the btrfs mailing list. Perhaps, I should have? >=20 > fs/btrfs/subvolume.c | 1 + > 1 file changed, 1 insertion(+) >=20 > diff --git a/fs/btrfs/subvolume.c b/fs/btrfs/subvolume.c > index d446e7a2c418..68ca7e48e48e 100644 > --- a/fs/btrfs/subvolume.c > +++ b/fs/btrfs/subvolume.c > @@ -199,6 +199,7 @@ static int list_subvolums(struct btrfs_fs_info *fs_in= fo) > ret =3D PTR_ERR(root); > if (ret =3D=3D -ENOENT) > goto next; > + goto out; > } > ret =3D list_one_subvol(root, result); > if (ret < 0) Reviewed-by: Marek Beh=C3=BAn nice catch :) Dan, I always wanted to ask, since I've seen many such "nice catches" over different subsystems from you. Do you write some tools to find these? Or do you use coccinelle, or something? Marek