| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAKisOQG=gLF=ac-70r0w3Z_oNnW=JBB2c6ObFwmHz8O-7PRzZw@mail.gmail.com>
Date: Mon, 5 Jan 2026 11:29:39 +0000
From: Filipe Manana <fdmanana@...e.com>
To: kernel test robot <lkp@...el.com>
Cc: oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org,
David Sterba <dsterba@...e.com>, Boris Burkov <boris@....io>
Subject: Re: fs/btrfs/ordered-data.c:215:5-11: ERROR: allocation function on
line 173 returns NULL not ERR_PTR on failure
On Fri, Jan 2, 2026 at 4:10 AM kernel test robot <lkp@...el.com> wrote:
>
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head: b69053dd3ffbc0d2dedbbc86182cdef6f641fe1b
> commit: 08c649a5637371cb6bf8f3e974323cf59a7f434b btrfs: check we grabbed inode reference when allocating an ordered extent
> date: 8 months ago
> config: arm-randconfig-r051-20251231 (https://download.01.org/0day-ci/archive/20260102/202601021217.PPsDsiqO-lkp@intel.com/config)
> compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 86b9f90b9574b3a7d15d28a91f6316459dcfa046)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@...el.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202601021217.PPsDsiqO-lkp@intel.com/
>
> cocci warnings: (new ones prefixed by >>)
> >> fs/btrfs/ordered-data.c:215:5-11: ERROR: allocation function on line 173 returns NULL not ERR_PTR on failure
False alarm.
The allocation function does indeed return NULL, but if that's the
case we set 'entry' to ERR_PTR(-ENOMEM) in line 175.
The only other error path sets entry to ERR_PTR(-ESTALE).
So it's perfectly fine to test for IS_ERR(entry) at line 215.
Thanks.
>
> vim +215 fs/btrfs/ordered-data.c
>
> 147
> 148 static struct btrfs_ordered_extent *alloc_ordered_extent(
> 149 struct btrfs_inode *inode, u64 file_offset, u64 num_bytes,
> 150 u64 ram_bytes, u64 disk_bytenr, u64 disk_num_bytes,
> 151 u64 offset, unsigned long flags, int compress_type)
> 152 {
> 153 struct btrfs_ordered_extent *entry;
> 154 int ret;
> 155 u64 qgroup_rsv = 0;
> 156 const bool is_nocow = (flags &
> 157 ((1U << BTRFS_ORDERED_NOCOW) | (1U << BTRFS_ORDERED_PREALLOC)));
> 158
> 159 if (is_nocow) {
> 160 /* For nocow write, we can release the qgroup rsv right now */
> 161 ret = btrfs_qgroup_free_data(inode, NULL, file_offset, num_bytes, &qgroup_rsv);
> 162 if (ret < 0)
> 163 return ERR_PTR(ret);
> 164 } else {
> 165 /*
> 166 * The ordered extent has reserved qgroup space, release now
> 167 * and pass the reserved number for qgroup_record to free.
> 168 */
> 169 ret = btrfs_qgroup_release_data(inode, file_offset, num_bytes, &qgroup_rsv);
> 170 if (ret < 0)
> 171 return ERR_PTR(ret);
> 172 }
> > 173 entry = kmem_cache_zalloc(btrfs_ordered_extent_cache, GFP_NOFS);
> 174 if (!entry) {
> 175 entry = ERR_PTR(-ENOMEM);
> 176 goto out;
> 177 }
> 178
> 179 entry->file_offset = file_offset;
> 180 entry->num_bytes = num_bytes;
> 181 entry->ram_bytes = ram_bytes;
> 182 entry->disk_bytenr = disk_bytenr;
> 183 entry->disk_num_bytes = disk_num_bytes;
> 184 entry->offset = offset;
> 185 entry->bytes_left = num_bytes;
> 186 if (WARN_ON_ONCE(!igrab(&inode->vfs_inode))) {
> 187 kmem_cache_free(btrfs_ordered_extent_cache, entry);
> 188 entry = ERR_PTR(-ESTALE);
> 189 goto out;
> 190 }
> 191 entry->inode = inode;
> 192 entry->compress_type = compress_type;
> 193 entry->truncated_len = (u64)-1;
> 194 entry->qgroup_rsv = qgroup_rsv;
> 195 entry->flags = flags;
> 196 refcount_set(&entry->refs, 1);
> 197 init_waitqueue_head(&entry->wait);
> 198 INIT_LIST_HEAD(&entry->list);
> 199 INIT_LIST_HEAD(&entry->log_list);
> 200 INIT_LIST_HEAD(&entry->root_extent_list);
> 201 INIT_LIST_HEAD(&entry->work_list);
> 202 INIT_LIST_HEAD(&entry->bioc_list);
> 203 init_completion(&entry->completion);
> 204
> 205 /*
> 206 * We don't need the count_max_extents here, we can assume that all of
> 207 * that work has been done at higher layers, so this is truly the
> 208 * smallest the extent is going to get.
> 209 */
> 210 spin_lock(&inode->lock);
> 211 btrfs_mod_outstanding_extents(inode, 1);
> 212 spin_unlock(&inode->lock);
> 213
> 214 out:
> > 215 if (IS_ERR(entry) && !is_nocow)
> 216 btrfs_qgroup_free_refroot(inode->root->fs_info,
> 217 btrfs_root_id(inode->root),
> 218 qgroup_rsv, BTRFS_QGROUP_RSV_DATA);
> 219
> 220 return entry;
> 221 }
> 222
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists