Skip to contentSkip to conversation

xfs: Fix error pointer dereference

PATCH Applied Ethan Tidmore 3 participants 3 messages Feb 20 – Feb 25

Subsystems (2)
Stable branch XFS filesystem
lore
Share & tools
lore

Ethan Tidmore

author
#0 lore raw

PATCH v4 1/1 xfs: Fix error pointer dereference

The function try_lookup_noperm() can return an error pointer and is not checked for one.

Add checks for error pointer in xrep_adoption_check_dcache() and xrep_adoption_zap_dcache().

Detected by Smatch:
fs/xfs/scrub/orphanage.c:449 xrep_adoption_check_dcache() error:
'd_child' dereferencing possible ERR_PTR()

fs/xfs/scrub/orphanage.c:485 xrep_adoption_zap_dcache() error:
'd_child' dereferencing possible ERR_PTR()

Fixes 73597e3e42b4 ("xfs: ensure dentry consistency when the orphanage adopts a file")
Cc <[email protected]> # v6.16
Signed-off-by Ethan Tidmore <[email protected]>
Reviewed-by "Darrick J. Wong" <[email protected]>

---
v4:
- Add blank line after closing brace.
v3:
- Add dput(d_orphanage) before returning error code in xrep_adoption_check_dcache().
- Revert xrep_adoption_zap_dcache() change back to v1 version.
- Include function names where error pointer checks were added. v2:
- Propagate the error back in xrep_adoption_check_dcache().
- Add Cc to stable.
- Add correct Fixes tag.

 fs/xfs/scrub/orphanage.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
fs/xfs/scrub/orphanage.c +6 -1
index 52a108f6d5f4..33c6db6b4498 100644
@@ -442,6 +442,11 @@ xrep_adoption_check_dcache(
 		return 0;
 
 	d_child = try_lookup_noperm(&qname, d_orphanage);
+	if (IS_ERR(d_child)) {
+		dput(d_orphanage);
+		return PTR_ERR(d_child);
+	}
+
 	if (d_child) {
 		trace_xrep_adoption_check_child(sc->mp, d_child);
 

@@ -479,7 +484,7 @@ xrep_adoption_zap_dcache(
 		return;
 
 	d_child = try_lookup_noperm(&qname, d_orphanage);
-	while (d_child != NULL) {
+	while (!IS_ERR_OR_NULL(d_child)) {
 		trace_xrep_adoption_invalidate_child(sc->mp, d_child);
 
 		ASSERT(d_is_negative(d_child));
Signature · 1 line
2.53.0
Reviewed-by on v4 1/1
#1 lore raw
Quoted 49 lines · Ethan Tidmore

The function try_lookup_noperm() can return an error pointer and is not checked for one.

Add checks for error pointer in xrep_adoption_check_dcache() and xrep_adoption_zap_dcache().

Detected by Smatch:
fs/xfs/scrub/orphanage.c:449 xrep_adoption_check_dcache() error:
'd_child' dereferencing possible ERR_PTR()

fs/xfs/scrub/orphanage.c:485 xrep_adoption_zap_dcache() error:
'd_child' dereferencing possible ERR_PTR()

Fixes 73597e3e42b4 ("xfs: ensure dentry consistency when the orphanage adopts a file")
Cc <[email protected]> # v6.16
Signed-off-by Ethan Tidmore <[email protected]>
Reviewed-by "Darrick J. Wong" <[email protected]>

---
v4:
- Add blank line after closing brace.
v3:
- Add dput(d_orphanage) before returning error code in xrep_adoption_check_dcache().
- Revert xrep_adoption_zap_dcache() change back to v1 version.
- Include function names where error pointer checks were added. v2:
- Propagate the error back in xrep_adoption_check_dcache().
- Add Cc to stable.
- Add correct Fixes tag.

 fs/xfs/scrub/orphanage.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
fs/xfs/scrub/orphanage.c +5 -0
index 52a108f6d5f4..33c6db6b4498 100644
@@ -442,6 +442,11 @@ xrep_adoption_check_dcache(
 		return 0;
 
 	d_child = try_lookup_noperm(&qname, d_orphanage);
+	if (IS_ERR(d_child)) {
+		dput(d_orphanage);
+		return PTR_ERR(d_child);
+	}
+
 	if (d_child) {
 		trace_xrep_adoption_check_child(sc->mp, d_child);

fs/xfs/scrub/orphanage.c xrep_adoption_zap_dcache( · line 490

Quoted 8 lines
fs/xfs/scrub/orphanage.c +1 -1
@@ -479,7 +484,7 @@ xrep_adoption_zap_dcache(
 		return;
 
 	d_child = try_lookup_noperm(&qname, d_orphanage);
-	while (d_child != NULL) {
+	while (!IS_ERR_OR_NULL(d_child)) {
 		trace_xrep_adoption_invalidate_child(sc->mp, d_child);
 
 		ASSERT(d_is_negative(d_child));

Okay, so you sent a v4. I gave my RB in v3 - also giving it here too. Based on my reviews in the previous version[1], this looks good to me.

Reviewed-by Nirjhar Roy (IBM) <[email protected]>

[1] https://lore.kernel.org/all/[email protected]/
--NR

maintainer Applied
#2 lore raw
In reply to Ethan Tidmore
Quoted 11 lines · Ethan Tidmore

The function try_lookup_noperm() can return an error pointer and is not checked for one.

Add checks for error pointer in xrep_adoption_check_dcache() and xrep_adoption_zap_dcache().

Detected by Smatch:
fs/xfs/scrub/orphanage.c:449 xrep_adoption_check_dcache() error:
'd_child' dereferencing possible ERR_PTR()

[...]

Applied to for-next, thanks!

[1/1] xfs: Fix error pointer dereference

      commit: 98899e053df0678bcabde2114d509b0e308cf52c

Best regards,

Signature · 1 line
Carlos Maiolino <[email protected]>