2024-02-26 15:17:04

by Harshit Mogalapalli

[permalink] [raw]
Subject: [PATCH] dm vdo: Fix a use-after-free in load_index_save()

Smatch warns:
drivers/md/dm-vdo/indexer/index-layout.c:1570
load_index_save() warn: 'table' was already freed.

Store the error value in result and then free the table before
returning.

Fixes: b46d79bdb82a ("dm vdo: add deduplication index storage interface")
Signed-off-by: Harshit Mogalapalli <[email protected]>
---
This is based on static analysis and only compile tested.
---
drivers/md/dm-vdo/indexer/index-layout.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/md/dm-vdo/indexer/index-layout.c b/drivers/md/dm-vdo/indexer/index-layout.c
index 1453fddaa656..18fac999e3e4 100644
--- a/drivers/md/dm-vdo/indexer/index-layout.c
+++ b/drivers/md/dm-vdo/indexer/index-layout.c
@@ -1566,10 +1566,11 @@ static int __must_check load_index_save(struct index_save_layout *isl,


if (table->header.type != RH_TYPE_SAVE) {
+ result = vdo_log_error_strerror(UDS_CORRUPT_DATA,
+ "unexpected index save %u header type %u",
+ instance, table->header.type);
vdo_free(table);
- return vdo_log_error_strerror(UDS_CORRUPT_DATA,
- "unexpected index save %u header type %u",
- instance, table->header.type);
+ return result;
}

result = read_index_save_data(reader, isl, table->header.payload);
--
2.39.3