linux-erofs.lists.ozlabs.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] erofs: fix double free of 'copied'
@ 2021-08-25 12:07 Gao Xiang
  2021-08-25 12:16 ` Chao Yu
  0 siblings, 1 reply; 2+ messages in thread
From: Gao Xiang @ 2021-08-25 12:07 UTC (permalink / raw)
  To: linux-erofs, Chao Yu, Liu Bo; +Cc: LKML, Dan Carpenter, kernel test robot

Dan reported a new smatch warning [1]
"fs/erofs/inode.c:210 erofs_read_inode() error: double free of 'copied'"

Due to new chunk-based format handling logic, the error path can be
called after kfree(copied).

Set "copied = NULL" after kfree(copied) to fix this.

[1] https://lore.kernel.org/r/202108251030.bELQozR7-lkp@intel.com
Fixes: c5aa903a59db ("erofs: support reading chunk-based uncompressed files")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
---
 fs/erofs/inode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c
index 4408929bd6f5..31ac3a73b390 100644
--- a/fs/erofs/inode.c
+++ b/fs/erofs/inode.c
@@ -127,6 +127,7 @@ static struct page *erofs_read_inode(struct inode *inode,
 			/* fill chunked inode summary info */
 			vi->chunkformat = le16_to_cpu(die->i_u.c.format);
 		kfree(copied);
+		copied = NULL;
 		break;
 	case EROFS_INODE_LAYOUT_COMPACT:
 		vi->inode_isize = sizeof(struct erofs_inode_compact);
-- 
2.24.4


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] erofs: fix double free of 'copied'
  2021-08-25 12:07 [PATCH] erofs: fix double free of 'copied' Gao Xiang
@ 2021-08-25 12:16 ` Chao Yu
  0 siblings, 0 replies; 2+ messages in thread
From: Chao Yu @ 2021-08-25 12:16 UTC (permalink / raw)
  To: Gao Xiang, linux-erofs, Liu Bo; +Cc: LKML, Dan Carpenter, kernel test robot

On 2021/8/25 20:07, Gao Xiang wrote:
> Dan reported a new smatch warning [1]
> "fs/erofs/inode.c:210 erofs_read_inode() error: double free of 'copied'"
> 
> Due to new chunk-based format handling logic, the error path can be
> called after kfree(copied).
> 
> Set "copied = NULL" after kfree(copied) to fix this.
> 
> [1] https://lore.kernel.org/r/202108251030.bELQozR7-lkp@intel.com
> Fixes: c5aa903a59db ("erofs: support reading chunk-based uncompressed files")
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>

Reviewed-by: Chao Yu <chao@kernel.org>

Thanks,

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-08-25 12:16 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-25 12:07 [PATCH] erofs: fix double free of 'copied' Gao Xiang
2021-08-25 12:16 ` Chao Yu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).