Re: [bug report] btrfs: turn fs_roots_radix in btrfs_fs_info into an XArray

[David Sterba <dsterba@suse.cz>]

On Wed, May 04, 2022 at 06:29:18PM +0300, Dan Carpenter wrote:
> Hello Gabriel Niebler,
> 
> The patch eb8da5bf4831: "btrfs: turn fs_roots_radix in btrfs_fs_info
> into an XArray" from Apr 26, 2022, leads to the following Smatch
> static checker warning:
> 
> fs/btrfs/disk-io.c:4453 btrfs_cleanup_fs_roots() error: uninitialized symbol 'i'.
> fs/btrfs/disk-io.c:4453 btrfs_cleanup_fs_roots() error: uninitialized symbol 'grabbed'.
> 
> fs/btrfs/disk-io.c
>     4408 int btrfs_cleanup_fs_roots(struct btrfs_fs_info *fs_info)
>     4409 {
>     4410         struct btrfs_root *roots[8];
>     4411         unsigned long index = 0;
>     4412         int i;
>     4413         int err = 0;
>     4414         int grabbed;
>     4415 
>     4416         while (1) {
>     4417                 struct btrfs_root *root;
>     4418 
>     4419                 spin_lock(&fs_info->fs_roots_lock);
>     4420                 if (!xa_find(&fs_info->fs_roots, &index, ULONG_MAX, XA_PRESENT)) {
>     4421                         spin_unlock(&fs_info->fs_roots_lock);
>     4422                         break;
> 
> "i" and "grabbed" are uninitialized if we hit this break statement on
> the first iteration through the loop.
> 
> roots is also uninitialized.  This error handling is badly broken.
> 
> If we hit it on the second iteration then we are also toasted.  Double
> frees.  I think.  (Trying to send emails quickly and then head out the
> door).

Thanks for the report, this has been meanwhile fixed in the tree,
Nikolay sent a fixup that replaced break with return.