linux-kernel - Re: [PATCH] ubifs: Remove a redundant null check on pointer lp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f2ea606a-4a05-8d14-4380-d96ca0f981a1@huawei.com>
Date:   Tue, 22 Jun 2021 10:38:52 +0800
From:   Zhihao Cheng <chengzhihao1@...wei.com>
To:     Colin King <colin.king@...onical.com>,
        Richard Weinberger <richard@....at>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        <linux-mtd@...ts.infradead.org>
CC:     <kernel-janitors@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] ubifs: Remove a redundant null check on pointer lp

在 2021/6/21 23:22, Colin King 写道:
> From: Colin Ian King <colin.king@...onical.com>
> 
> An earlier fix to replace an IS_ERR check on lp with a null check
> on lp didn't remove a following null check on lp. The second null
> check is redundant and can be removed.
> 
> Addresses-Coverity: ("Logically dead code")
> Fixes: c770cd5190ba ("ubifs: fix an IS_ERR() vs NULL check")
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>   fs/ubifs/gc.c | 2 --
>   1 file changed, 2 deletions(-)
> 
> diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
> index 7cc22d7317ea..465beea52176 100644
> --- a/fs/ubifs/gc.c
> +++ b/fs/ubifs/gc.c
> @@ -899,8 +899,6 @@ int ubifs_gc_start_commit(struct ubifs_info *c)
>   			err = -ENOMEM;
>   			goto out;
>   		}
Hi Colin,
I just found out about it today thanks to your patch. Commit 
c770cd5190ba ("ubifs: fix an IS_ERR() vs NULL check") did import a new 
problem that ubifs_gc_start_commit() may return -ENOMEM while syncing fs.
I guess ubifs_fast_find_frdi_idx() return NULL pointer is the 
termination condition in while-loop, which means we cannot get a 
freeable index LEB in ubifs_gc_start_commit().

> -		if (!lp)
> -			break;
>   		idx_gc = kmalloc(sizeof(struct ubifs_gced_idx_leb), GFP_NOFS);
>   		if (!idx_gc) {
>   			err = -ENOMEM;
> 
BTW, the following modifications may be what you want?
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 7cc22d7317ea..b1f276599b04 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -895,10 +895,6 @@ int ubifs_gc_start_commit(struct ubifs_info *c)
         /* Record index freeable LEBs for unmapping after commit */
         while (1) {
                 lp = ubifs_fast_find_frdi_idx(c);
-               if (!lp) {
-                       err = -ENOMEM;
-                       goto out;
-               }
                 if (!lp)
                         break;
                 idx_gc = kmalloc(sizeof(struct ubifs_gced_idx_leb), 
GFP_NOFS);