2017-06-30 07:56:53

by Dan Carpenter

Subject: [PATCH] ext4: don't free an error pointer

"goto out;" calls brelse(bh); which will oops on this this path where
"bh" is an error pointer.

Fixes: 2851a40a5d71 ("ext4: xattr-in-inode support")
Signed-off-by: Dan Carpenter <[email protected]>
---
Oops. I wrote a bug report and a patch for this... Probably we only
need the patch.


diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index ce12c3fb7e59..f7d6845e147b 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1305,10 +1305,8 @@ static int ext4_xattr_inode_write(handle_t *handle, struct inode *ea_inode,
csize = (bufsize - wsize) > blocksize ? blocksize :
bufsize - wsize;
bh = ext4_getblk(handle, ea_inode, block, 0);
- if (IS_ERR(bh)) {
- ret = PTR_ERR(bh);
- goto out;
- }
+ if (IS_ERR(bh))
+ return PTR_ERR(bh);
ret = ext4_journal_get_write_access(handle, bh);
if (ret)
goto out;

2017-06-30 11:17:58

by Tahsin Erdogan

Subject: Re: [PATCH] ext4: don't free an error pointer

Reviewed-by: Tahsin Erdogan <[email protected]>

On Fri, Jun 30, 2017 at 12:56 AM, Dan Carpenter
<[email protected]> wrote:
> "goto out;" calls brelse(bh); which will oops on this this path where
> "bh" is an error pointer.
>
> Fixes: 2851a40a5d71 ("ext4: xattr-in-inode support")
> Signed-off-by: Dan Carpenter <[email protected]>
> ---
> Oops. I wrote a bug report and a patch for this... Probably we only
> need the patch.
>
>
> diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
> index ce12c3fb7e59..f7d6845e147b 100644
> --- a/fs/ext4/xattr.c
> +++ b/fs/ext4/xattr.c
> @@ -1305,10 +1305,8 @@ static int ext4_xattr_inode_write(handle_t *handle, struct inode *ea_inode,
> csize = (bufsize - wsize) > blocksize ? blocksize :
> bufsize - wsize;
> bh = ext4_getblk(handle, ea_inode, block, 0);
> - if (IS_ERR(bh)) {
> - ret = PTR_ERR(bh);
> - goto out;
> - }
> + if (IS_ERR(bh))
> + return PTR_ERR(bh);
> ret = ext4_journal_get_write_access(handle, bh);
> if (ret)
> goto out;

2017-07-04 01:37:57

by Theodore Ts'o

Subject: Re: [PATCH] ext4: don't free an error pointer

On Fri, Jun 30, 2017 at 10:56:53AM +0300, Dan Carpenter wrote:
> "goto out;" calls brelse(bh); which will oops on this this path where
> "bh" is an error pointer.
>
> Fixes: 2851a40a5d71 ("ext4: xattr-in-inode support")
> Signed-off-by: Dan Carpenter <[email protected]>
> ---
> Oops. I wrote a bug report and a patch for this... Probably we only
> need the patch.

Thanks, I've folded your this to the xattr-in-inode patch and added a
credit for the bugfix to the commit log.

- Ted