[bug report] xfs: connect refcount adjust functions to upper layers

[bug report] xfs: connect refcount adjust functions to upper layers

[Dan Carpenter]

Hello Darrick J. Wong,

The patch 33ba61292084: "xfs: connect refcount adjust functions to
upper layers" from Oct 3, 2016, leads to the following static checker
warning:

	fs/xfs/xfs_refcount_item.c:535 xfs_cui_recover()
	warn: passing freed memory 'rcur'

fs/xfs/xfs_refcount_item.c
   523                  }
   524          }
   525  
   526          xfs_refcount_finish_one_cleanup(tp, rcur, error);
                                                    ^^^^
Freed here.

   527          error = xfs_defer_finish(&tp, &dfops, NULL);
   528          if (error)
   529                  goto abort_error;
   530          set_bit(XFS_CUI_RECOVERED, &cuip->cui_flags);
   531          error = xfs_trans_commit(tp);
   532          return error;
   533  
   534  abort_error:
   535          xfs_refcount_finish_one_cleanup(tp, rcur, error);
                                                    ^^^^
Again here...

   536          xfs_defer_cancel(&dfops);
   537          xfs_trans_cancel(tp);
   538          return error;
   539  }

regards,
dan carpenter

Re: [bug report] xfs: connect refcount adjust functions to upper layers

[Darrick J. Wong]

On Thu, Dec 15, 2016 at 03:23:57PM +0300, Dan Carpenter wrote:
> Hello Darrick J. Wong,
> 
> The patch 33ba61292084: "xfs: connect refcount adjust functions to
> upper layers" from Oct 3, 2016, leads to the following static checker
> warning:
> 
> 	fs/xfs/xfs_refcount_item.c:535 xfs_cui_recover()
> 	warn: passing freed memory 'rcur'
> 
> fs/xfs/xfs_refcount_item.c
>    523                  }
>    524          }
>    525  
>    526          xfs_refcount_finish_one_cleanup(tp, rcur, error);
>                                                     ^^^^
> Freed here.
> 
>    527          error = xfs_defer_finish(&tp, &dfops, NULL);
>    528          if (error)
>    529                  goto abort_error;
>    530          set_bit(XFS_CUI_RECOVERED, &cuip->cui_flags);
>    531          error = xfs_trans_commit(tp);
>    532          return error;
>    533  
>    534  abort_error:
>    535          xfs_refcount_finish_one_cleanup(tp, rcur, error);
>                                                     ^^^^
> Again here...

Yep, definitely a bug.  I'll make a fix.

--D

> 
>    536          xfs_defer_cancel(&dfops);
>    537          xfs_trans_cancel(tp);
>    538          return error;
>    539  }
> 
> regards,
> dan carpenter
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html