Skip to contentSkip to conversation

Btrfs progs, coverity fixes for 3.18

PATCH In review David Sterba 2 participants 14 messages Dec 19, 2014 Btrfs file system

lore
Share & tools
lore

David Sterba

author
#0 lore raw

cover Btrfs progs, coverity fixes for 3.18

A few straightforward fixes.

David Sterba (6):
btrfs-progs: corrupt block, add missing break to option I
btrfs-progs: corrupt block, add break after option U
btrfs-progs: fragments, close output file on error
btrfs-progs: check result of first_cache_extent
btrfs-progs: check allocation result in add_clone_source
btrfs-progs: let btrfs_free_path accept NULL

 btrfs-corrupt-block.c |  2 ++
 btrfs-fragments.c     |  7 +++++--
 cmds-check.c          |  2 ++
 cmds-send.c           | 25 +++++++++++++++++++++----
 ctree.c               |  2 ++
 5 files changed, 32 insertions(+), 6 deletions(-)
Signature · 1 line
2.1.3
author
#1 lore raw

PATCH 1/6 btrfs-progs: corrupt block, add missing break to option I

Using -I would imply -d.

Resolves-Coverity-CID: 1258792

Signed-off-by David Sterba <[email protected]>
---
 btrfs-corrupt-block.c | 1 +
 1 file changed, 1 insertion(+)
btrfs-corrupt-block.c +1 -0
index af9ae4d4047c..aeeb1b298f66 100644
@@ -1096,6 +1096,7 @@ int main(int ac, char **av)
 				break;
 			case 'I':
 				corrupt_item = 1;
+				break;
 			case 'd':
 				delete = 1;
 				break;
Signature · 1 line
2.1.3
author
#3 lore raw

PATCH 2/6 btrfs-progs: corrupt block, add break after option U

In reply to David Sterba

Resolves-Coverity-CID: 1258793

Signed-off-by David Sterba <[email protected]>
---
 btrfs-corrupt-block.c | 1 +
 1 file changed, 1 insertion(+)
btrfs-corrupt-block.c +1 -0
index aeeb1b298f66..b477e878376b 100644
@@ -1068,6 +1068,7 @@ int main(int ac, char **av)
 				break;
 			case 'U':
 				chunk_tree = 1;
+				break;
 			case 'i':
 				inode = arg_strtou64(optarg);
 				break;
Signature · 1 line
2.1.3
author
#5 lore raw

PATCH 3/6 btrfs-progs: fragments, close output file on error

In reply to David Sterba

Resolves-Coverity-CID: 1258794

Signed-off-by David Sterba <[email protected]>
---
 btrfs-fragments.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
btrfs-fragments.c +5 -2
index d03c2c3e7319..360f10f87bfa 100644
@@ -233,7 +233,7 @@ list_fragments(int fd, u64 flags, char *dir)
 		ret = ioctl(fd, BTRFS_IOC_TREE_SEARCH, &args);
 		if (ret < 0) {
 			fprintf(stderr, "ERROR: can't perform the search\n");
-			return ret;
+			goto out_close;
 		}
 		/* the ioctl returns the number of item it found in nr_items */
 		if (sk->nr_items == 0)

@@ -373,7 +373,10 @@ skip:;
 		fprintf(html, "</p>");
 	}
 	fprintf(html, "</body></html>\n");
-	
+
+out_close:
+	fclose(html);
+
 	return ret;
 }
Signature · 1 line
2.1.3
author
#7 lore raw

PATCH 4/6 btrfs-progs: check result of first_cache_extent

In reply to David Sterba

If the tree's empty, we'll get NULL and dereference it.

Resolves-Coverity-CID: 1248828

Signed-off-by David Sterba <[email protected]>
---
 cmds-check.c | 2 ++
 1 file changed, 2 insertions(+)
cmds-check.c +2 -0
index 6eea36c2f52c..3e7a4ebdce44 100644
@@ -8075,6 +8075,8 @@ static void free_roots_info_cache(void)
 		struct root_item_info *rii;
 
 		entry = first_cache_extent(roots_info_cache);
+		if (!entry)
+			break;
 		remove_cache_extent(roots_info_cache, entry);
 		rii = container_of(entry, struct root_item_info, cache_extent);
 		free(rii);
Signature · 1 line
2.1.3
author
#10 lore raw

PATCH 5/6 btrfs-progs: check allocation result in add_clone_source

In reply to David Sterba

Resolves-Coverity-CID: 1054894

Signed-off-by David Sterba <[email protected]>
---
 cmds-send.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)
cmds-send.c +21 -4
index b17b5e2ca666..9b32c1f0e624 100644
@@ -172,11 +172,16 @@ out:
 	return ret;
 }
 
-static void add_clone_source(struct btrfs_send *s, u64 root_id)
+static int add_clone_source(struct btrfs_send *s, u64 root_id)
 {
 	s->clone_sources = realloc(s->clone_sources,
 		sizeof(*s->clone_sources) * (s->clone_sources_count + 1));
+
+	if (!s->clone_sources)
+		return -ENOMEM;
 	s->clone_sources[s->clone_sources_count++] = root_id;
+
+	return 0;
 }
 
 static int write_buf(int fd, const void *buf, int size)

@@ -475,7 +480,11 @@ int cmd_send(int argc, char **argv)
 				goto out;
 			}
 
-			add_clone_source(&send, root_id);
+			ret = add_clone_source(&send, root_id);
+			if (ret < 0) {
+				fprintf(stderr, "ERROR: not enough memory\n");
+				goto out;
+			}
 			subvol_uuid_search_finit(&send.sus);
 			free(subvol);
 			subvol = NULL;

@@ -575,7 +584,11 @@ int cmd_send(int argc, char **argv)
 			goto out;
 		}
 
-		add_clone_source(&send, parent_root_id);
+		ret = add_clone_source(&send, parent_root_id);
+		if (ret < 0) {
+			fprintf(stderr, "ERROR: not enough memory\n");
+			goto out;
+		}
 	}
 
 	for (i = optind; i < argc; i++) {

@@ -671,7 +684,11 @@ int cmd_send(int argc, char **argv)
 			goto out;
 
 		/* done with this subvol, so add it to the clone sources */
-		add_clone_source(&send, root_id);
+		ret = add_clone_source(&send, root_id);
+		if (ret < 0) {
+			fprintf(stderr, "ERROR: not enough memory\n");
+			goto out;
+		}
 
 		parent_root_id = 0;
 		full_send = 0;
Signature · 1 line
2.1.3
author
#12 lore raw

PATCH 6/6 btrfs-progs: let btrfs_free_path accept NULL

In reply to David Sterba

Same in kernel and matches semantics of free().

Resolves-Coverity-CID: 1054881

Signed-off-by David Sterba <[email protected]>
---
 ctree.c | 2 ++
 1 file changed, 2 insertions(+)
ctree.c +2 -0
index bd6cb125b2a2..589efa3db17e 100644
@@ -48,6 +48,8 @@ struct btrfs_path *btrfs_alloc_path(void)
 
 void btrfs_free_path(struct btrfs_path *p)
 {
+	if (!p)
+		return;
 	btrfs_release_path(p);
 	kfree(p);
 }
Signature · 1 line
2.1.3
Reviewed-by on v1 1/6
#2 lore raw

Re: [PATCH 1/6] btrfs-progs: corrupt block, add missing break to option I

In reply to David Sterba
Quoted 4 lines · David Sterba

Using -I would imply -d.

Resolves-Coverity-CID: 1258792

Signed-off-by David Sterba <[email protected]>
Reviewed-by Eric Sandeen <[email protected]>
Quoted 17 lines
---
 btrfs-corrupt-block.c | 1 +
 1 file changed, 1 insertion(+)
btrfs-corrupt-block.c +1 -0
index af9ae4d4047c..aeeb1b298f66 100644
@@ -1096,6 +1096,7 @@ int main(int ac, char **av)
 				break;
 			case 'I':
 				corrupt_item = 1;
+				break;
 			case 'd':
 				delete = 1;
 				break;
Reviewed-by on v1 2/6
#4 lore raw

Re: [PATCH 2/6] btrfs-progs: corrupt block, add break after option U

In reply to David Sterba
Quoted 2 lines · David Sterba

Resolves-Coverity-CID: 1258793

Signed-off-by David Sterba <[email protected]>
Reviewed-by Eric Sandeen <[email protected]>
Quoted 17 lines
---
 btrfs-corrupt-block.c | 1 +
 1 file changed, 1 insertion(+)
btrfs-corrupt-block.c +1 -0
index aeeb1b298f66..b477e878376b 100644
@@ -1068,6 +1068,7 @@ int main(int ac, char **av)
 				break;
 			case 'U':
 				chunk_tree = 1;
+				break;
 			case 'i':
 				inode = arg_strtou64(optarg);
 				break;
Reviewed-by on v1 3/6
#6 lore raw

Re: [PATCH 3/6] btrfs-progs: fragments, close output file on error

In reply to David Sterba
Quoted 2 lines · David Sterba

Resolves-Coverity-CID: 1258794

Signed-off-by David Sterba <[email protected]>
Reviewed-by Eric Sandeen <[email protected]>
Quoted 30 lines
---
 btrfs-fragments.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
btrfs-fragments.c +5 -2
index d03c2c3e7319..360f10f87bfa 100644
@@ -233,7 +233,7 @@ list_fragments(int fd, u64 flags, char *dir)
 		ret = ioctl(fd, BTRFS_IOC_TREE_SEARCH, &args);
 		if (ret < 0) {
 			fprintf(stderr, "ERROR: can't perform the search\n");
-			return ret;
+			goto out_close;
 		}
 		/* the ioctl returns the number of item it found in nr_items */
 		if (sk->nr_items == 0)

@@ -373,7 +373,10 @@ skip:;
 		fprintf(html, "</p>");
 	}
 	fprintf(html, "</body></html>\n");
-	
+
+out_close:
+	fclose(html);
+
 	return ret;
 }
Reviewed-by on v1 4/6
#8 lore raw

Re: [PATCH 4/6] btrfs-progs: check result of first_cache_extent

In reply to David Sterba
Quoted 1 line · David Sterba

If the tree's empty, we'll get NULL and dereference it.

Hm, but this is under an explicit check for not empty:

        while (!cache_tree_empty(roots_info_cache)) {

sooo? Maybe it's just defensive? Nothing really wrong with being defensive, I suppose, so:

Reviewed-by Eric Sandeen <[email protected]>
Quoted 20 lines

Resolves-Coverity-CID: 1248828

Signed-off-by David Sterba <[email protected]>
---
 cmds-check.c | 2 ++
 1 file changed, 2 insertions(+)
cmds-check.c +2 -0
index 6eea36c2f52c..3e7a4ebdce44 100644
@@ -8075,6 +8075,8 @@ static void free_roots_info_cache(void)
 		struct root_item_info *rii;
 
 		entry = first_cache_extent(roots_info_cache);
+		if (!entry)
+			break;
 		remove_cache_extent(roots_info_cache, entry);
 		rii = container_of(entry, struct root_item_info, cache_extent);
 		free(rii);
Reviewed-by on v1 5/6
#11 lore raw

Re: [PATCH 5/6] btrfs-progs: check allocation result in add_clone_source

In reply to David Sterba
Quoted 2 lines · David Sterba

Resolves-Coverity-CID: 1054894

Signed-off-by David Sterba <[email protected]>
Reviewed-by Eric Sandeen <[email protected]>
Quoted 66 lines
---
 cmds-send.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)
cmds-send.c +21 -4
index b17b5e2ca666..9b32c1f0e624 100644
@@ -172,11 +172,16 @@ out:
 	return ret;
 }
 
-static void add_clone_source(struct btrfs_send *s, u64 root_id)
+static int add_clone_source(struct btrfs_send *s, u64 root_id)
 {
 	s->clone_sources = realloc(s->clone_sources,
 		sizeof(*s->clone_sources) * (s->clone_sources_count + 1));
+
+	if (!s->clone_sources)
+		return -ENOMEM;
 	s->clone_sources[s->clone_sources_count++] = root_id;
+
+	return 0;
 }
 
 static int write_buf(int fd, const void *buf, int size)

@@ -475,7 +480,11 @@ int cmd_send(int argc, char **argv)
 				goto out;
 			}
 
-			add_clone_source(&send, root_id);
+			ret = add_clone_source(&send, root_id);
+			if (ret < 0) {
+				fprintf(stderr, "ERROR: not enough memory\n");
+				goto out;
+			}
 			subvol_uuid_search_finit(&send.sus);
 			free(subvol);
 			subvol = NULL;

@@ -575,7 +584,11 @@ int cmd_send(int argc, char **argv)
 			goto out;
 		}
 
-		add_clone_source(&send, parent_root_id);
+		ret = add_clone_source(&send, parent_root_id);
+		if (ret < 0) {
+			fprintf(stderr, "ERROR: not enough memory\n");
+			goto out;
+		}
 	}
 
 	for (i = optind; i < argc; i++) {

@@ -671,7 +684,11 @@ int cmd_send(int argc, char **argv)
 			goto out;
 
 		/* done with this subvol, so add it to the clone sources */
-		add_clone_source(&send, root_id);
+		ret = add_clone_source(&send, root_id);
+		if (ret < 0) {
+			fprintf(stderr, "ERROR: not enough memory\n");
+			goto out;
+		}
 
 		parent_root_id = 0;
 		full_send = 0;
Reviewed-by on v1 6/6
#13 lore raw

Re: [PATCH 6/6] btrfs-progs: let btrfs_free_path accept NULL

In reply to David Sterba
Quoted 4 lines · David Sterba

Same in kernel and matches semantics of free().

Resolves-Coverity-CID: 1054881

Signed-off-by David Sterba <[email protected]>
Reviewed-by Eric Sandeen <[email protected]>
Quoted 18 lines
---
 ctree.c | 2 ++
 1 file changed, 2 insertions(+)
ctree.c +2 -0
index bd6cb125b2a2..589efa3db17e 100644
@@ -48,6 +48,8 @@ struct btrfs_path *btrfs_alloc_path(void)
 
 void btrfs_free_path(struct btrfs_path *p)
 {
+	if (!p)
+		return;
 	btrfs_release_path(p);
 	kfree(p);
 }
author
#9 lore raw

Re: [PATCH 4/6] btrfs-progs: check result of first_cache_extent

In reply to Eric Sandeen
Quoted 9 lines · Eric Sandeen
Quoted 1 line · David Sterba

If the tree's empty, we'll get NULL and dereference it.

Hm, but this is under an explicit check for not empty:

        while (!cache_tree_empty(roots_info_cache)) {

sooo? Maybe it's just defensive? Nothing really wrong with being defensive, I suppose, so:

Well, mostly to shut up the warning with a minimal change. It could be rewritten to

	while ((entry = ...)) { ... }

as in other places.