gfs2: Fix error pointer dereference
PATCH 1/1 gfs2: Fix error pointer dereference
The function __filemap_get_folio() can return an error pointer and is not checked for one. Add check for error pointer.
Detected by Smatch:fs/gfs2/meta_io.c:147 gfs2_getbuf() error:
'folio' dereferencing possible ERR_PTR()
--- fs/gfs2/meta_io.c | 2 ++ 1 file changed, 2 insertions(+)
fs/gfs2/meta_io.c +2 -0
@@ -144,6 +144,8 @@ struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, int create) folio =__filemap_get_folio (mapping, index,FGP_LOCK |FGP_ACCESSED |FGP_CREAT ,mapping_gfp_mask (mapping) | __GFP_NOFAIL); +if (IS_ERR (folio)) +return NULL ; bh =folio_buffers (folio);if (!bh) bh = create_empty_buffers(folio,
Signature · 1 line
2.53.0
Quoted 2 lines · Ethan Tidmore
The function
__filemap_get_folio()can return an error pointer and is not checked for one. Add check for error pointer.
Can you explain how __filemap_get_folio() would fail, given the presence of __GFP_NOFAIL in the GFP flags?
Quoted 26 lines
Detected by Smatch:
fs/gfs2/meta_io.c:147gfs2_getbuf()error:
'folio' dereferencing possibleERR_PTR()Fixes 0eb751791df86 ("gfs2: convert gfs2_getbuf() to folios")Signed-off-by Ethan Tidmore <[email protected]>--- fs/gfs2/meta_io.c | 2 ++ 1 file changed, 2 insertions(+)fs/gfs2/meta_io.c +2
-0@@ -144,6 +144,8 @@ struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, int create) folio =__filemap_get_folio (mapping, index,FGP_LOCK |FGP_ACCESSED |FGP_CREAT ,mapping_gfp_mask (mapping) | __GFP_NOFAIL); +if (IS_ERR (folio)) +return NULL ; bh =folio_buffers (folio);if (!bh) bh = create_empty_buffers(folio,Signature · 1 line
2.53.0
Quoted 7 lines · Matthew Wilcox
Quoted 2 lines · Ethan Tidmore
The function
__filemap_get_folio()can return an error pointer and is not checked for one. Add check for error pointer.Can you explain how
__filemap_get_folio()would fail, given the presence of__GFP_NOFAILin the GFP flags?
I hadn't thought of that, looks like Smatch gave me a false positive. I just saw the same function being called a few lines down and its return value being checked for error pointer so I just assumed this one was missing. Sorry about that.
Thanks,
ET