[PATCH] btrfs: fix error pointer dereference in btrfs_ioctl_rm_dev_v2()

* [PATCH] btrfs: fix error pointer dereference in btrfs_ioctl_rm_dev_v2()
@ 2021-11-16 11:50 Dan Carpenter
  2021-11-16 14:39 ` Josef Bacik
  2021-11-16 16:19 ` David Sterba
  0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2021-11-16 11:50 UTC (permalink / raw)
  To: Chris Mason, Josef Bacik
  Cc: David Sterba, Anand Jain, linux-btrfs, kernel-janitors

If memdup_user() fails the error handing will crash when it tries
to kfree() an error pointer.  Just return directly because there is
no cleanup required.

Fixes: 1a15eb724aae ("btrfs: use btrfs_get_dev_args_from_path in dev removal ioctls")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 fs/btrfs/ioctl.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index fb8cc9642ac4..32df384b40c8 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3187,10 +3187,8 @@ static long btrfs_ioctl_rm_dev_v2(struct file *file, void __user *arg)
 		return -EPERM;
 
 	vol_args = memdup_user(arg, sizeof(*vol_args));
-	if (IS_ERR(vol_args)) {
-		ret = PTR_ERR(vol_args);
-		goto out;
-	}
+	if (IS_ERR(vol_args))
+		return PTR_ERR(vol_args);
 
 	if (vol_args->flags & ~BTRFS_DEVICE_REMOVE_ARGS_MASK) {
 		ret = -EOPNOTSUPP;
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 3+ messages in thread