* [patch 1/2] Ocfs2/move_extents: fix error handling in ioctl
@ 2013-04-04 6:37 Dan Carpenter
2013-04-04 9:21 ` Jeff Liu
0 siblings, 1 reply; 6+ messages in thread
From: Dan Carpenter @ 2013-04-04 6:37 UTC (permalink / raw)
To: ocfs2-devel
Smatch complains that if we hit an error (for example if the file is
immutable) then "range" has uninitialized stack data and we copy it to
the user.
I've re-written the error handling to avoid this problem.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
index 9f8dcad..995d1b4 100644
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -1057,25 +1057,25 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
struct inode *inode = file_inode(filp);
struct ocfs2_move_extents range;
- struct ocfs2_move_extents_context *context = NULL;
+ struct ocfs2_move_extents_context *context;
status = mnt_want_write_file(filp);
if (status)
return status;
if ((!S_ISREG(inode->i_mode)) || !(filp->f_mode & FMODE_WRITE))
- goto out;
+ goto out_drop;
if (inode->i_flags & (S_IMMUTABLE|S_APPEND)) {
status = -EPERM;
- goto out;
+ goto out_drop;
}
context = kzalloc(sizeof(struct ocfs2_move_extents_context), GFP_NOFS);
if (!context) {
status = -ENOMEM;
mlog_errno(status);
- goto out;
+ goto out_drop;
}
context->inode = inode;
@@ -1084,15 +1084,15 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
if (argp) {
if (copy_from_user(&range, argp, sizeof(range))) {
status = -EFAULT;
- goto out;
+ goto out_free;
}
} else {
status = -EINVAL;
- goto out;
+ goto out_free;
}
if (range.me_start > i_size_read(inode))
- goto out;
+ goto out_free;
if (range.me_start + range.me_len > i_size_read(inode))
range.me_len = i_size_read(inode) - range.me_start;
@@ -1124,13 +1124,13 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
status = ocfs2_validate_and_adjust_move_goal(inode, &range);
if (status)
- goto out;
+ goto out_copy;
}
status = ocfs2_move_extents(context);
if (status)
mlog_errno(status);
-out:
+out_copy:
/*
* movement/defragmentation may end up being partially completed,
* that's the reason why we need to return userspace the finished
@@ -1141,8 +1141,9 @@ out:
status = -EFAULT;
}
+out_free:
kfree(context);
-
+out_drop:
mnt_drop_write_file(filp);
return status;
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [patch 1/2] Ocfs2/move_extents: fix error handling in ioctl
2013-04-04 6:37 [patch 1/2] Ocfs2/move_extents: fix error handling in ioctl Dan Carpenter
@ 2013-04-04 9:21 ` Jeff Liu
2013-04-04 11:40 ` [patch 1/2 v2] " Dan Carpenter
0 siblings, 1 reply; 6+ messages in thread
From: Jeff Liu @ 2013-04-04 9:21 UTC (permalink / raw)
To: ocfs2-devel
Hi Dan,
On 04/04/2013 02:37 PM, Dan Carpenter wrote:
> Smatch complains that if we hit an error (for example if the file is
> immutable) then "range" has uninitialized stack data and we copy it to
> the user.
Yes, We should copy the status of movement/defragmentation back to user
only if this procedure has been issued although it may be only partially
completed.
I personally would suggest to do a bit code adjustment for this function
combine your current fix if you like, the related comments are inline.
>
> I've re-written the error handling to avoid this problem.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
> index 9f8dcad..995d1b4 100644
> --- a/fs/ocfs2/move_extents.c
> +++ b/fs/ocfs2/move_extents.c
> @@ -1057,25 +1057,25 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
>
> struct inode *inode = file_inode(filp);
> struct ocfs2_move_extents range;
> - struct ocfs2_move_extents_context *context = NULL;
> + struct ocfs2_move_extents_context *context;
>
Just return if argv is invalid, i.e. NULL.
if (!argv)
return -EINVAL;
> status = mnt_want_write_file(filp);
> if (status)
> return status;
>
> if ((!S_ISREG(inode->i_mode)) || !(filp->f_mode & FMODE_WRITE))
> - goto out;
> + goto out_drop;
>
> if (inode->i_flags & (S_IMMUTABLE|S_APPEND)) {
> status = -EPERM;
> - goto out;
> + goto out_drop;
> }
>
> context = kzalloc(sizeof(struct ocfs2_move_extents_context), GFP_NOFS);
> if (!context) {
> status = -ENOMEM;
> mlog_errno(status);
> - goto out;
> + goto out_drop;
> }
>
> context->inode = inode;
> @@ -1084,15 +1084,15 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
> if (argp) {
> if (copy_from_user(&range, argp, sizeof(range))) {
> status = -EFAULT;
> - goto out;
> + goto out_free;
> }
With above pre-checking up against 'argv', we can kill the following conditional code
block and try to copy the input range directly.
if (copy_from_user(&range, ...)) {
....
}
> } else {
> status = -EINVAL;
> - goto out;
> + goto out_free;
> }
>
> if (range.me_start > i_size_read(inode))
> - goto out;
> + goto out_free;
>
> if (range.me_start + range.me_len > i_size_read(inode))
> range.me_len = i_size_read(inode) - range.me_start;
> @@ -1124,13 +1124,13 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
>
> status = ocfs2_validate_and_adjust_move_goal(inode, &range);
> if (status)
> - goto out;
> + goto out_copy;
> }
>
> status = ocfs2_move_extents(context);
> if (status)
> mlog_errno(status);
> -out:
> +out_copy:
So with the beginning pre-checkup, we don't need to verify argp again that the
original code does.
- if (argp) {
- if (copy_to_user(argp, &range, sizeof(range)))
- status = -EFAULT;
- }
+ if (copy_to_user(argp, &range, sizeof(range)))
+ status = -EFAULT;
> /*
> * movement/defragmentation may end up being partially completed,
> * that's the reason why we need to return userspace the finished
> @@ -1141,8 +1141,9 @@ out:
> status = -EFAULT;
> }
>
> +out_free:
> kfree(context);
> -
> +out_drop:
> mnt_drop_write_file(filp);
>
> return status;
Thanks,
-Jeff
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 6+ messages in thread* [patch 1/2 v2] Ocfs2/move_extents: fix error handling in ioctl
2013-04-04 9:21 ` Jeff Liu
@ 2013-04-04 11:40 ` Dan Carpenter
2013-04-04 11:52 ` Jeff Liu
0 siblings, 1 reply; 6+ messages in thread
From: Dan Carpenter @ 2013-04-04 11:40 UTC (permalink / raw)
To: ocfs2-devel
Smatch complains that if we hit an error (for example if the file is
immutable) then "range" has uninitialized stack data and we copy it to
the user.
I've re-written the error handling to avoid this problem and make it a
little cleaner as well.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: check for argp earlier
diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
index 9f8dcad..8f3d3cb 100644
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -1057,42 +1057,40 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
struct inode *inode = file_inode(filp);
struct ocfs2_move_extents range;
- struct ocfs2_move_extents_context *context = NULL;
+ struct ocfs2_move_extents_context *context;
+
+ if (!argp)
+ return -EINVAL;
status = mnt_want_write_file(filp);
if (status)
return status;
if ((!S_ISREG(inode->i_mode)) || !(filp->f_mode & FMODE_WRITE))
- goto out;
+ goto out_drop;
if (inode->i_flags & (S_IMMUTABLE|S_APPEND)) {
status = -EPERM;
- goto out;
+ goto out_drop;
}
context = kzalloc(sizeof(struct ocfs2_move_extents_context), GFP_NOFS);
if (!context) {
status = -ENOMEM;
mlog_errno(status);
- goto out;
+ goto out_drop;
}
context->inode = inode;
context->file = filp;
- if (argp) {
- if (copy_from_user(&range, argp, sizeof(range))) {
- status = -EFAULT;
- goto out;
- }
- } else {
- status = -EINVAL;
- goto out;
+ if (copy_from_user(&range, argp, sizeof(range))) {
+ status = -EFAULT;
+ goto out_free;
}
if (range.me_start > i_size_read(inode))
- goto out;
+ goto out_free;
if (range.me_start + range.me_len > i_size_read(inode))
range.me_len = i_size_read(inode) - range.me_start;
@@ -1124,25 +1122,24 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
status = ocfs2_validate_and_adjust_move_goal(inode, &range);
if (status)
- goto out;
+ goto out_copy;
}
status = ocfs2_move_extents(context);
if (status)
mlog_errno(status);
-out:
+out_copy:
/*
* movement/defragmentation may end up being partially completed,
* that's the reason why we need to return userspace the finished
* length and new_offset even if failure happens somewhere.
*/
- if (argp) {
- if (copy_to_user(argp, &range, sizeof(range)))
- status = -EFAULT;
- }
+ if (copy_to_user(argp, &range, sizeof(range)))
+ status = -EFAULT;
+out_free:
kfree(context);
-
+out_drop:
mnt_drop_write_file(filp);
return status;
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [patch 1/2 v2] Ocfs2/move_extents: fix error handling in ioctl
2013-04-04 11:40 ` [patch 1/2 v2] " Dan Carpenter
@ 2013-04-04 11:52 ` Jeff Liu
2013-04-09 0:04 ` [Ocfs2-devel] " Andrew Morton
0 siblings, 1 reply; 6+ messages in thread
From: Jeff Liu @ 2013-04-04 11:52 UTC (permalink / raw)
To: ocfs2-devel
On 04/04/2013 07:40 PM, Dan Carpenter wrote:
> Smatch complains that if we hit an error (for example if the file is
> immutable) then "range" has uninitialized stack data and we copy it to
> the user.
>
> I've re-written the error handling to avoid this problem and make it a
> little cleaner as well.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jie Liu <jeff.liu@oracle.com>
> ---
> v2: check for argp earlier
>
> diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
> index 9f8dcad..8f3d3cb 100644
> --- a/fs/ocfs2/move_extents.c
> +++ b/fs/ocfs2/move_extents.c
> @@ -1057,42 +1057,40 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
>
> struct inode *inode = file_inode(filp);
> struct ocfs2_move_extents range;
> - struct ocfs2_move_extents_context *context = NULL;
> + struct ocfs2_move_extents_context *context;
> +
> + if (!argp)
> + return -EINVAL;
>
> status = mnt_want_write_file(filp);
> if (status)
> return status;
>
> if ((!S_ISREG(inode->i_mode)) || !(filp->f_mode & FMODE_WRITE))
> - goto out;
> + goto out_drop;
>
> if (inode->i_flags & (S_IMMUTABLE|S_APPEND)) {
> status = -EPERM;
> - goto out;
> + goto out_drop;
> }
>
> context = kzalloc(sizeof(struct ocfs2_move_extents_context), GFP_NOFS);
> if (!context) {
> status = -ENOMEM;
> mlog_errno(status);
> - goto out;
> + goto out_drop;
> }
>
> context->inode = inode;
> context->file = filp;
>
> - if (argp) {
> - if (copy_from_user(&range, argp, sizeof(range))) {
> - status = -EFAULT;
> - goto out;
> - }
> - } else {
> - status = -EINVAL;
> - goto out;
> + if (copy_from_user(&range, argp, sizeof(range))) {
> + status = -EFAULT;
> + goto out_free;
> }
>
> if (range.me_start > i_size_read(inode))
> - goto out;
> + goto out_free;
>
> if (range.me_start + range.me_len > i_size_read(inode))
> range.me_len = i_size_read(inode) - range.me_start;
> @@ -1124,25 +1122,24 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
>
> status = ocfs2_validate_and_adjust_move_goal(inode, &range);
> if (status)
> - goto out;
> + goto out_copy;
> }
>
> status = ocfs2_move_extents(context);
> if (status)
> mlog_errno(status);
> -out:
> +out_copy:
> /*
> * movement/defragmentation may end up being partially completed,
> * that's the reason why we need to return userspace the finished
> * length and new_offset even if failure happens somewhere.
> */
> - if (argp) {
> - if (copy_to_user(argp, &range, sizeof(range)))
> - status = -EFAULT;
> - }
> + if (copy_to_user(argp, &range, sizeof(range)))
> + status = -EFAULT;
>
> +out_free:
> kfree(context);
> -
> +out_drop:
> mnt_drop_write_file(filp);
>
> return status;
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Ocfs2-devel] [patch 1/2 v2] Ocfs2/move_extents: fix error handling in ioctl
2013-04-04 11:52 ` Jeff Liu
@ 2013-04-09 0:04 ` Andrew Morton
2013-04-09 3:13 ` Jeff Liu
0 siblings, 1 reply; 6+ messages in thread
From: Andrew Morton @ 2013-04-09 0:04 UTC (permalink / raw)
To: ocfs2-devel
On Thu, 04 Apr 2013 19:52:36 +0800 Jeff Liu <jeff.liu@oracle.com> wrote:
> On 04/04/2013 07:40 PM, Dan Carpenter wrote:
> > Smatch complains that if we hit an error (for example if the file is
> > immutable) then "range" has uninitialized stack data and we copy it to
> > the user.
> >
> > I've re-written the error handling to avoid this problem and make it a
> > little cleaner as well.
> >
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Reviewed-by: Jie Liu <jeff.liu@oracle.com>
I can't find either of Dan's emails anywhere. Confused.
Resend both, please?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Ocfs2-devel] [patch 1/2 v2] Ocfs2/move_extents: fix error handling in ioctl
2013-04-09 0:04 ` [Ocfs2-devel] " Andrew Morton
@ 2013-04-09 3:13 ` Jeff Liu
0 siblings, 0 replies; 6+ messages in thread
From: Jeff Liu @ 2013-04-09 3:13 UTC (permalink / raw)
To: ocfs2-devel
On 04/09/2013 08:04 AM, Andrew Morton wrote:
> On Thu, 04 Apr 2013 19:52:36 +0800 Jeff Liu <jeff.liu@oracle.com> wrote:
>
>> On 04/04/2013 07:40 PM, Dan Carpenter wrote:
>>> Smatch complains that if we hit an error (for example if the file is
>>> immutable) then "range" has uninitialized stack data and we copy it to
>>> the user.
>>>
>>> I've re-written the error handling to avoid this problem and make it a
>>> little cleaner as well.
>>>
>>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>> Reviewed-by: Jie Liu <jeff.liu@oracle.com>
>
> I can't find either of Dan's emails anywhere. Confused.
>
> Resend both, please?
Looks they were eaten by the mailing list somehow, I'll resent both of
them on behalf of Dan in a minute.
Thanks,
-Jeff
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-04-09 3:13 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-04-04 6:37 [patch 1/2] Ocfs2/move_extents: fix error handling in ioctl Dan Carpenter
2013-04-04 9:21 ` Jeff Liu
2013-04-04 11:40 ` [patch 1/2 v2] " Dan Carpenter
2013-04-04 11:52 ` Jeff Liu
2013-04-09 0:04 ` [Ocfs2-devel] " Andrew Morton
2013-04-09 3:13 ` Jeff Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox