Skip to contentSkip to conversation

btrfs: fix check_shared for fiemap ioctl

DISCUSSION Dan Carpenter 2 participants 2 messages Jun 7, 2016 – Jun 8, 2016 Btrfs file system

lore
Share & tools
lore
#0 lore raw

Hello Lu Fengqi,

The patch ac8332f0c3ac: "btrfs: fix check_shared for fiemap ioctl" from Jun 1, 2016, leads to the following static checker warning:

	fs/btrfs/backref.c:277 ref_tree_add()
	error: dereferencing freed memory 'node'

fs/btrfs/backref.c
271 origin_count = node->ref_mod;
272 node->ref_mod += count;
273
274 if (!node->ref_mod)

   275                  ref_tree_remove(ref_tree, node);
                                                  ^^^^

Freed here.

276
277 if (node->ref_mod > 0)

                    ^^^^^^^^^^^^^

Use after free.

   278                  ref_tree->unique_refs += origin_count > 0 ? 0 : 1;
   279          else if (node->ref_mod <= 0)
   280                  ref_tree->unique_refs += origin_count > 0 ? -1 : 0;
   281  
   282          return 0;

regards,
dan carpenter

#1 lore raw
Quoted 22 lines · Dan Carpenter

Hello Lu Fengqi,

The patch ac8332f0c3ac: "btrfs: fix check_shared for fiemap ioctl" from Jun 1, 2016, leads to the following static checker warning:

	fs/btrfs/backref.c:277 ref_tree_add()
	error: dereferencing freed memory 'node'

fs/btrfs/backref.c

   271          origin_count = node->ref_mod;
   272          node->ref_mod += count;
   273
   274          if (!node->ref_mod)
   275                  ref_tree_remove(ref_tree, node);
                                                  ^^^^

Freed here.

   276
   277          if (node->ref_mod > 0)
                    ^^^^^^^^^^^^^

Use after free.

Quoted 10 lines
   278                  ref_tree->unique_refs += origin_count > 0 ? 0 : 1;
   279          else if (node->ref_mod <= 0)
   280                  ref_tree->unique_refs += origin_count > 0 ? -1 : 0;
   281
   282          return 0;

regards,
dan carpenter

Yes, this warning is right. I will update this patch to correct it.

Signature · 2 lines
Thanks,
Lu