linux-kernel - [PATCH v3] btrfs: add missing check after link_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20191210085623.17737-1-dinghao.liu@zju.edu.cn>
Date:   Tue, 10 Dec 2019 16:56:22 +0800
From:   Dinghao Liu <dinghao.liu@....edu.cn>
To:     dinghao.liu@....edu.cn, kjlu@....edu
Cc:     Chris Mason <clm@...com>, Josef Bacik <josef@...icpanda.com>,
        David Sterba <dsterba@...e.com>, linux-btrfs@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH v3] btrfs: add missing check after link_free_space

The return value of link_free_space is checked out-sync.
One branch of an if statement uses an extra check after
WARN_ON() but its peer branch does not. WARN_ON() does
not change the control flow, thus only using this check
might be insufficient.

Fix this by simply adding a check on ret.

The repeated kmem_cache_free branches have not been merged 
because this will influence the original control flow. If 
the control flow does not step into the if (ret) branch, 
then we actually need not to free memory again.

Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn>
--
Changes in v3:
  - Remove WARN_ON after link_free_space
---
 fs/btrfs/free-space-cache.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 3283da419200..ae4eea12fc9a 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -2436,7 +2436,10 @@ int btrfs_remove_free_space(struct btrfs_block_group *block_group,
 			info->offset += to_free;
 			if (info->bytes) {
 				ret = link_free_space(ctl, info);
-				WARN_ON(ret);
+				if (ret) {
+					kmem_cache_free(btrfs_free_space_cachep, info);
+					goto out_lock;
+				}
 			} else {
 				kmem_cache_free(btrfs_free_space_cachep, info);
 			}
@@ -2449,7 +2452,6 @@ int btrfs_remove_free_space(struct btrfs_block_group *block_group,
 
 			info->bytes = offset - info->offset;
 			ret = link_free_space(ctl, info);
-			WARN_ON(ret);
 			if (ret)
 				goto out_lock;
 
-- 
2.21.0 (Apple Git-122)