Re: [PATCH 4/9] btrfs: fix UAF due to race between replace start and cancel

[Anand Jain <anand.jain@oracle.com>]

On 11/15/2018 11:25 PM, David Sterba wrote:
> On Thu, Nov 15, 2018 at 03:00:21PM +0100, David Sterba wrote:
>> On Wed, Nov 14, 2018 at 09:28:34AM +0800, Anand Jain wrote:
>>>>>    	mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
>>>>>    	return result;
>>>>
>>>> There's a compiler warning:
>>>>
>>>> fs/btrfs/dev-replace.c: In function ‘btrfs_dev_replace_cancel’:
>>>> fs/btrfs/dev-replace.c:865:9: warning: ‘result’ may be used uninitialized in this function [-Wmaybe-uninitialized]
>>>>     return result;
>>>>            ^~~~~~
>>>
>>>> I haven't looked closer though it looks valid.
>>>
>>> int result; is assigned within switch(), so there isn't actual problem.
>>
>> The warning is there because switch (dev_replace->replace_state) does
>> not have a default: case that would catch the values outside of what's
>> defined by the enum. So in that case result would have undefined value.
>>
>>> But will initialize the result to -EINVAL to quite the compiler.
>>> Sending v3.
>>
>> I don't see any change in the followup version.
>> https://patchwork.kernel.org/patch/10681939/

  Looks like I didn't run git commit --amend, now pulled your changes
  from misc-next.

> I've added
> 
> 	default:
> 		result = -EINVAL;
> 
> to the end of the switch.

  Ok. misc-next looks good to me.

Thanks, Anand