linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild@01.org, Kangjie Lu <kjlu@umn.edu>
Cc: kbuild-all@01.org, kjlu@umn.edu, pakki001@umn.edu,
	David Sterba <dsterba@suse.com>,
	linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] fs: affs: fix a NULL pointer dereference
Date: Tue, 19 Mar 2019 12:00:53 +0300	[thread overview]
Message-ID: <20190319090053.GK2227@kadam> (raw)
In-Reply-To: <20190314074607.28041-1-kjlu@umn.edu>

Hi Kangjie,

Thank you for the patch! Perhaps something to improve:

url:    https://github.com/0day-ci/linux/commits/Kangjie-Lu/fs-affs-fix-a-NULL-pointer-dereference/20190314-170334

New smatch warnings:
fs/affs/file.c:951 affs_truncate() error: we previously assumed 'ext_bh' could be null (see line 944)

Old smatch warnings:
fs/affs/file.c:806 affs_write_end_ofs() warn: passing zero to 'PTR_ERR'

# https://github.com/0day-ci/linux/commit/2ee20c56bd586ddaf3ebdb1c3cad26439edc9eb6
git remote add linux-review https://github.com/0day-ci/linux
git remote update linux-review
git checkout 2ee20c56bd586ddaf3ebdb1c3cad26439edc9eb6
vim +/ext_bh +951 fs/affs/file.c

^1da177e4 Linus Torvalds     2005-04-16  833  
^1da177e4 Linus Torvalds     2005-04-16  834  void
^1da177e4 Linus Torvalds     2005-04-16  835  affs_truncate(struct inode *inode)
^1da177e4 Linus Torvalds     2005-04-16  836  {
^1da177e4 Linus Torvalds     2005-04-16  837  	struct super_block *sb = inode->i_sb;
2ee20c56b Kangjie Lu         2019-03-14  838  	u32 ext, ext_key, ext_bk;
^1da177e4 Linus Torvalds     2005-04-16  839  	u32 last_blk, blkcnt, blk;
^1da177e4 Linus Torvalds     2005-04-16  840  	u32 size;
^1da177e4 Linus Torvalds     2005-04-16  841  	struct buffer_head *ext_bh;
^1da177e4 Linus Torvalds     2005-04-16  842  	int i;
^1da177e4 Linus Torvalds     2005-04-16  843  
08fe100d9 Geert Uytterhoeven 2015-02-17  844  	pr_debug("truncate(inode=%lu, oldsize=%llu, newsize=%llu)\n",
08fe100d9 Geert Uytterhoeven 2015-02-17  845  		 inode->i_ino, AFFS_I(inode)->mmu_private, inode->i_size);
^1da177e4 Linus Torvalds     2005-04-16  846  
^1da177e4 Linus Torvalds     2005-04-16  847  	last_blk = 0;
^1da177e4 Linus Torvalds     2005-04-16  848  	ext = 0;
^1da177e4 Linus Torvalds     2005-04-16  849  	if (inode->i_size) {
^1da177e4 Linus Torvalds     2005-04-16  850  		last_blk = ((u32)inode->i_size - 1) / AFFS_SB(sb)->s_data_blksize;
^1da177e4 Linus Torvalds     2005-04-16  851  		ext = last_blk / AFFS_SB(sb)->s_hashsize;
^1da177e4 Linus Torvalds     2005-04-16  852  	}
^1da177e4 Linus Torvalds     2005-04-16  853  
^1da177e4 Linus Torvalds     2005-04-16  854  	if (inode->i_size > AFFS_I(inode)->mmu_private) {
^1da177e4 Linus Torvalds     2005-04-16  855  		struct address_space *mapping = inode->i_mapping;
^1da177e4 Linus Torvalds     2005-04-16  856  		struct page *page;
f2b6a16eb Nick Piggin        2007-10-16  857  		void *fsdata;
73516ace9 Fabian Frederick   2014-10-13  858  		loff_t isize = inode->i_size;
^1da177e4 Linus Torvalds     2005-04-16  859  		int res;
^1da177e4 Linus Torvalds     2005-04-16  860  
73516ace9 Fabian Frederick   2014-10-13  861  		res = mapping->a_ops->write_begin(NULL, mapping, isize, 0, 0, &page, &fsdata);
^1da177e4 Linus Torvalds     2005-04-16  862  		if (!res)
73516ace9 Fabian Frederick   2014-10-13  863  			res = mapping->a_ops->write_end(NULL, mapping, isize, 0, 0, page, fsdata);
dca3c3365 Roman Zippel       2008-04-29  864  		else
dca3c3365 Roman Zippel       2008-04-29  865  			inode->i_size = AFFS_I(inode)->mmu_private;
^1da177e4 Linus Torvalds     2005-04-16  866  		mark_inode_dirty(inode);
^1da177e4 Linus Torvalds     2005-04-16  867  		return;
^1da177e4 Linus Torvalds     2005-04-16  868  	} else if (inode->i_size == AFFS_I(inode)->mmu_private)
^1da177e4 Linus Torvalds     2005-04-16  869  		return;
^1da177e4 Linus Torvalds     2005-04-16  870  
^1da177e4 Linus Torvalds     2005-04-16  871  	// lock cache
^1da177e4 Linus Torvalds     2005-04-16  872  	ext_bh = affs_get_extblock(inode, ext);
^1da177e4 Linus Torvalds     2005-04-16  873  	if (IS_ERR(ext_bh)) {
1ee54b099 Fabian Frederick   2014-12-12  874  		affs_warning(sb, "truncate",
1ee54b099 Fabian Frederick   2014-12-12  875  			     "unexpected read error for ext block %u (%ld)",
08fe100d9 Geert Uytterhoeven 2015-02-17  876  			     ext, PTR_ERR(ext_bh));
^1da177e4 Linus Torvalds     2005-04-16  877  		return;
^1da177e4 Linus Torvalds     2005-04-16  878  	}
^1da177e4 Linus Torvalds     2005-04-16  879  	if (AFFS_I(inode)->i_lc) {
^1da177e4 Linus Torvalds     2005-04-16  880  		/* clear linear cache */
^1da177e4 Linus Torvalds     2005-04-16  881  		i = (ext + 1) >> AFFS_I(inode)->i_lc_shift;
^1da177e4 Linus Torvalds     2005-04-16  882  		if (AFFS_I(inode)->i_lc_size > i) {
^1da177e4 Linus Torvalds     2005-04-16  883  			AFFS_I(inode)->i_lc_size = i;
^1da177e4 Linus Torvalds     2005-04-16  884  			for (; i < AFFS_LC_SIZE; i++)
^1da177e4 Linus Torvalds     2005-04-16  885  				AFFS_I(inode)->i_lc[i] = 0;
^1da177e4 Linus Torvalds     2005-04-16  886  		}
^1da177e4 Linus Torvalds     2005-04-16  887  		/* clear associative cache */
^1da177e4 Linus Torvalds     2005-04-16  888  		for (i = 0; i < AFFS_AC_SIZE; i++)
^1da177e4 Linus Torvalds     2005-04-16  889  			if (AFFS_I(inode)->i_ac[i].ext >= ext)
^1da177e4 Linus Torvalds     2005-04-16  890  				AFFS_I(inode)->i_ac[i].ext = 0;
^1da177e4 Linus Torvalds     2005-04-16  891  	}
^1da177e4 Linus Torvalds     2005-04-16  892  	ext_key = be32_to_cpu(AFFS_TAIL(sb, ext_bh)->extension);
^1da177e4 Linus Torvalds     2005-04-16  893  
^1da177e4 Linus Torvalds     2005-04-16  894  	blkcnt = AFFS_I(inode)->i_blkcnt;
^1da177e4 Linus Torvalds     2005-04-16  895  	i = 0;
^1da177e4 Linus Torvalds     2005-04-16  896  	blk = last_blk;
^1da177e4 Linus Torvalds     2005-04-16  897  	if (inode->i_size) {
^1da177e4 Linus Torvalds     2005-04-16  898  		i = last_blk % AFFS_SB(sb)->s_hashsize + 1;
^1da177e4 Linus Torvalds     2005-04-16  899  		blk++;
^1da177e4 Linus Torvalds     2005-04-16  900  	} else
^1da177e4 Linus Torvalds     2005-04-16  901  		AFFS_HEAD(ext_bh)->first_data = 0;
dca3c3365 Roman Zippel       2008-04-29  902  	AFFS_HEAD(ext_bh)->block_count = cpu_to_be32(i);
^1da177e4 Linus Torvalds     2005-04-16  903  	size = AFFS_SB(sb)->s_hashsize;
^1da177e4 Linus Torvalds     2005-04-16  904  	if (size > blkcnt - blk + i)
^1da177e4 Linus Torvalds     2005-04-16  905  		size = blkcnt - blk + i;
^1da177e4 Linus Torvalds     2005-04-16  906  	for (; i < size; i++, blk++) {
^1da177e4 Linus Torvalds     2005-04-16  907  		affs_free_block(sb, be32_to_cpu(AFFS_BLOCK(sb, ext_bh, i)));
^1da177e4 Linus Torvalds     2005-04-16  908  		AFFS_BLOCK(sb, ext_bh, i) = 0;
^1da177e4 Linus Torvalds     2005-04-16  909  	}
^1da177e4 Linus Torvalds     2005-04-16  910  	AFFS_TAIL(sb, ext_bh)->extension = 0;
^1da177e4 Linus Torvalds     2005-04-16  911  	affs_fix_checksum(sb, ext_bh);
^1da177e4 Linus Torvalds     2005-04-16  912  	mark_buffer_dirty_inode(ext_bh, inode);
^1da177e4 Linus Torvalds     2005-04-16  913  	affs_brelse(ext_bh);
^1da177e4 Linus Torvalds     2005-04-16  914  
^1da177e4 Linus Torvalds     2005-04-16  915  	if (inode->i_size) {
^1da177e4 Linus Torvalds     2005-04-16  916  		AFFS_I(inode)->i_blkcnt = last_blk + 1;
^1da177e4 Linus Torvalds     2005-04-16  917  		AFFS_I(inode)->i_extcnt = ext + 1;
79bda4d51 Fabian Frederick   2015-04-16  918  		if (affs_test_opt(AFFS_SB(sb)->s_flags, SF_OFS)) {
^1da177e4 Linus Torvalds     2005-04-16  919  			struct buffer_head *bh = affs_bread_ino(inode, last_blk, 0);
^1da177e4 Linus Torvalds     2005-04-16  920  			u32 tmp;
0e45b67d5 Dan Carpenter      2010-08-25  921  			if (IS_ERR(bh)) {
1ee54b099 Fabian Frederick   2014-12-12  922  				affs_warning(sb, "truncate",
1ee54b099 Fabian Frederick   2014-12-12  923  					     "unexpected read error for last block %u (%ld)",
08fe100d9 Geert Uytterhoeven 2015-02-17  924  					     ext, PTR_ERR(bh));
^1da177e4 Linus Torvalds     2005-04-16  925  				return;
^1da177e4 Linus Torvalds     2005-04-16  926  			}
^1da177e4 Linus Torvalds     2005-04-16  927  			tmp = be32_to_cpu(AFFS_DATA_HEAD(bh)->next);
^1da177e4 Linus Torvalds     2005-04-16  928  			AFFS_DATA_HEAD(bh)->next = 0;
^1da177e4 Linus Torvalds     2005-04-16  929  			affs_adjust_checksum(bh, -tmp);
^1da177e4 Linus Torvalds     2005-04-16  930  			affs_brelse(bh);
^1da177e4 Linus Torvalds     2005-04-16  931  		}
^1da177e4 Linus Torvalds     2005-04-16  932  	} else {
^1da177e4 Linus Torvalds     2005-04-16  933  		AFFS_I(inode)->i_blkcnt = 0;
^1da177e4 Linus Torvalds     2005-04-16  934  		AFFS_I(inode)->i_extcnt = 1;
^1da177e4 Linus Torvalds     2005-04-16  935  	}
^1da177e4 Linus Torvalds     2005-04-16  936  	AFFS_I(inode)->mmu_private = inode->i_size;
^1da177e4 Linus Torvalds     2005-04-16  937  	// unlock cache
^1da177e4 Linus Torvalds     2005-04-16  938  
^1da177e4 Linus Torvalds     2005-04-16  939  	while (ext_key) {
^1da177e4 Linus Torvalds     2005-04-16  940  		ext_bh = affs_bread(sb, ext_key);
^1da177e4 Linus Torvalds     2005-04-16  941  		size = AFFS_SB(sb)->s_hashsize;
^1da177e4 Linus Torvalds     2005-04-16  942  		if (size > blkcnt - blk)
^1da177e4 Linus Torvalds     2005-04-16  943  			size = blkcnt - blk;
2ee20c56b Kangjie Lu         2019-03-14 @944  		if (ext_bh) {
2ee20c56b Kangjie Lu         2019-03-14  945  			for (i = 0; i < size; i++, blk++) {
2ee20c56b Kangjie Lu         2019-03-14  946  				ext_bk = AFFS_BLOCK(sb, ext_bh, i);
2ee20c56b Kangjie Lu         2019-03-14  947  				affs_free_block(sb, be32_to_cpu(ext_bk));
2ee20c56b Kangjie Lu         2019-03-14  948  			}
2ee20c56b Kangjie Lu         2019-03-14  949  		}
^1da177e4 Linus Torvalds     2005-04-16  950  		affs_free_block(sb, ext_key);
^1da177e4 Linus Torvalds     2005-04-16 @951  		ext_key = be32_to_cpu(AFFS_TAIL(sb, ext_bh)->extension);
^1da177e4 Linus Torvalds     2005-04-16  952  		affs_brelse(ext_bh);
^1da177e4 Linus Torvalds     2005-04-16  953  	}
^1da177e4 Linus Torvalds     2005-04-16  954  	affs_free_prealloc(inode);
^1da177e4 Linus Torvalds     2005-04-16  955  }
c47587955 Al Viro            2009-06-08  956  

:::::: The code at line 951 was first introduced by commit
:::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2

:::::: TO: Linus Torvalds <torvalds@ppc970.osdl.org>
:::::: CC: Linus Torvalds <torvalds@ppc970.osdl.org>

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

  parent reply	other threads:[~2019-03-19  9:01 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-14  7:46 [PATCH] fs: affs: fix a NULL pointer dereference Kangjie Lu
2019-03-14 14:51 ` kbuild test robot
2019-03-19  9:00 ` Dan Carpenter [this message]
2019-03-19 13:43 ` Geert Uytterhoeven
2019-03-15  7:42 Kangjie Lu
2019-03-21 14:45 ` David Sterba

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190319090053.GK2227@kadam \
    --to=dan.carpenter@oracle.com \
    --cc=dsterba@suse.com \
    --cc=kbuild-all@01.org \
    --cc=kbuild@01.org \
    --cc=kjlu@umn.edu \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pakki001@umn.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).