linux-kernel - [PATCH] fuse: Improve error handling in two functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <70ebc121-4332-4c64-9a20-29837758aa19@web.de>
Date: Thu, 28 Dec 2023 22:02:13 +0100
From: Markus Elfring <Markus.Elfring@....de>
To: linux-fsdevel@...r.kernel.org, kernel-janitors@...r.kernel.org,
 Miklos Szeredi <miklos@...redi.hu>
Cc: LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH] fuse: Improve error handling in two functions

From: Markus Elfring <elfring@...rs.sourceforge.net>
Date: Thu, 28 Dec 2023 21:57:00 +0100

The kfree() function was called in two cases during error handling
even if the passed variable contained a null pointer.
This issue was detected by using the Coccinelle software.

* Thus use additional labels.

* Move error code assignments into if branches.

* Delete initialisations (for the variable “err”)
  which became unnecessary with this refactoring.

Signed-off-by: Markus Elfring <elfring@...rs.sourceforge.net>
---
 fs/fuse/dev.c | 44 ++++++++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 18 deletions(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 1a8f82f478cb..8f2975b1aed3 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1468,29 +1468,30 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
 				   struct fuse_copy_state *cs)
 {
 	struct fuse_notify_inval_entry_out outarg;
-	int err = -ENOMEM;
+	int err;
 	char *buf;
 	struct qstr name;

 	buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
-	if (!buf)
-		goto err;
+	if (!buf) {
+		err = -ENOMEM;
+		goto finish_copy;
+	}

-	err = -EINVAL;
 	if (size < sizeof(outarg))
-		goto err;
+		goto e_inval;

 	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
 	if (err)
 		goto err;

-	err = -ENAMETOOLONG;
-	if (outarg.namelen > FUSE_NAME_MAX)
+	if (outarg.namelen > FUSE_NAME_MAX) {
+		err = -ENAMETOOLONG;
 		goto err;
+	}

-	err = -EINVAL;
 	if (size != sizeof(outarg) + outarg.namelen + 1)
-		goto err;
+		goto e_inval;

 	name.name = buf;
 	name.len = outarg.namelen;
@@ -1506,8 +1507,11 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
 	kfree(buf);
 	return err;

+e_inval:
+	err = -EINVAL;
 err:
 	kfree(buf);
+finish_copy:
 	fuse_copy_finish(cs);
 	return err;
 }
@@ -1516,29 +1520,30 @@ static int fuse_notify_delete(struct fuse_conn *fc, unsigned int size,
 			      struct fuse_copy_state *cs)
 {
 	struct fuse_notify_delete_out outarg;
-	int err = -ENOMEM;
+	int err;
 	char *buf;
 	struct qstr name;

 	buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
-	if (!buf)
-		goto err;
+	if (!buf) {
+		err = -ENOMEM;
+		goto finish_copy;
+	}

-	err = -EINVAL;
 	if (size < sizeof(outarg))
-		goto err;
+		goto e_inval;

 	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
 	if (err)
 		goto err;

-	err = -ENAMETOOLONG;
-	if (outarg.namelen > FUSE_NAME_MAX)
+	if (outarg.namelen > FUSE_NAME_MAX) {
+		err = -ENAMETOOLONG;
 		goto err;
+	}

-	err = -EINVAL;
 	if (size != sizeof(outarg) + outarg.namelen + 1)
-		goto err;
+		goto e_inval;

 	name.name = buf;
 	name.len = outarg.namelen;
@@ -1554,8 +1559,11 @@ static int fuse_notify_delete(struct fuse_conn *fc, unsigned int size,
 	kfree(buf);
 	return err;

+e_inval:
+	err = -EINVAL;
 err:
 	kfree(buf);
+finish_copy:
 	fuse_copy_finish(cs);
 	return err;
 }
--
2.43.0