btrfs: fix check_shared for fiemap ioctl
Hello Lu Fengqi,
The patch ac8332f0c3ac: "btrfs: fix check_shared for fiemap ioctl" from Jun 1, 2016, leads to the following static checker warning:
fs/btrfs/backref.c:277 ref_tree_add() error: dereferencing freed memory 'node'
fs/btrfs/backref.c
271 origin_count = node->ref_mod;
272 node->ref_mod += count;
273
274 if (!node->ref_mod)
275 ref_tree_remove(ref_tree, node);
^^^^Freed here.
276
277 if (node->ref_mod > 0)
^^^^^^^^^^^^^
Use after free.
278 ref_tree->unique_refs += origin_count > 0 ? 0 : 1; 279 else if (node->ref_mod <= 0) 280 ref_tree->unique_refs += origin_count > 0 ? -1 : 0; 281 282 return 0;
regards,
dan carpenter
Quoted 22 lines · Dan Carpenter
Hello Lu Fengqi,
The patch
ac8332f0c3ac: "btrfs: fixcheck_sharedfor fiemap ioctl" from Jun 1, 2016, leads to the following static checker warning:fs/btrfs/backref.c:277 ref_tree_add() error: dereferencing freed memory 'node'
fs/btrfs/backref.c271 origin_count = node->ref_mod; 272 node->ref_mod += count; 273 274 if (!node->ref_mod) 275 ref_tree_remove(ref_tree, node); ^^^^Freed here.
276 277 if (node->ref_mod > 0) ^^^^^^^^^^^^^Use after free.
Quoted 10 lines
278 ref_tree->unique_refs += origin_count > 0 ? 0 : 1; 279 else if (node->ref_mod <= 0) 280 ref_tree->unique_refs += origin_count > 0 ? -1 : 0; 281 282 return 0;regards,
dan carpenter
Yes, this warning is right. I will update this patch to correct it.
Signature · 2 lines
Thanks, Lu