linux-kernel - Re: [PATCH] btrfs: fix error value in btrfs_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c30a0a5e-dfd5-8bee-63f6-c93af9dc7eb6@suse.com>
Date:   Mon, 3 Aug 2020 12:50:31 +0300
From:   Nikolay Borisov <nborisov@...e.com>
To:     Pavel Machek <pavel@...x.de>, clm@...com, jbacik@...com,
        dsterba@...e.com, sashal@...nel.org, wqu@...e.com,
        linux-btrfs@...r.kernel.org, linux-kernel@...r.kernel.org,
        jungyeon@...ech.edu, stable@...nel.org
Subject: Re: [PATCH] btrfs: fix error value in btrfs_get_extent



On 3.08.20 г. 12:39 ч., Nikolay Borisov wrote:
> 
> 
> On 3.08.20 г. 12:35 ч., Pavel Machek wrote:
>> btrfs_get_extent() sets variable ret, but out: error path expect error
>> to be in variable err. Fix that.
>>
>> Signed-off-by: Pavel Machek (CIP) <pavel@...x.de>
> 
> Good catch, this also needs:
> 
> Fixes: 6bf9e4bd6a27 ("btrfs: inode: Verify inode mode to avoid NULL
> pointer dereference")
> 
> Reviewed-by: Nikolay Borisov <nborisov@...e.com>

Actually the reason this error got introduced in the first place and I
missed it during the review is that the function is doing something
rather counter-intuitive - it's using 'err' variable as a synonym for
'ret'. A better approach would be to simply remove 'err' from that
function. I'm now authoring such a patch, nevertheless the issue still
stands.

> 
> 
>>
>> ---
>>
>> Notice that patch introducing this problem is on its way to 4.19.137-stable.
>>
>> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
>> index 7befb7c12bd3..4aaa01540f89 100644
>> --- a/fs/btrfs/inode.c
>> +++ b/fs/btrfs/inode.c
>> @@ -7012,7 +7012,7 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,
>>  	    found_type == BTRFS_FILE_EXTENT_PREALLOC) {
>>  		/* Only regular file could have regular/prealloc extent */
>>  		if (!S_ISREG(inode->vfs_inode.i_mode)) {
>> -			ret = -EUCLEAN;
>> +			err = -EUCLEAN;
>>  			btrfs_crit(fs_info,
>>  		"regular/prealloc extent found for non-regular inode %llu",
>>  				   btrfs_ino(inode));
>>
>