diff options
| author | Gao Xiang <hsiangkao@linux.alibaba.com> | 2021-08-25 20:07:57 +0800 |
|---|---|---|
| committer | Gao Xiang <hsiangkao@linux.alibaba.com> | 2021-08-25 22:05:58 +0800 |
| commit | 1266b4a7ecb679587dc4d098abe56ea53313d569 (patch) | |
| tree | d6583315427965eae54a2725916e083694748ab5 /fs/erofs | |
| parent | c5aa903a59db274554718cddfda9039913409ec9 (diff) | |
erofs: fix double free of 'copied'
Dan reported a new smatch warning [1]
"fs/erofs/inode.c:210 erofs_read_inode() error: double free of 'copied'"
Due to new chunk-based format handling logic, the error path can be
called after kfree(copied).
Set "copied = NULL" after kfree(copied) to fix this.
[1] https://lore.kernel.org/r/202108251030.bELQozR7-lkp@intel.com
Link: https://lore.kernel.org/r/20210825120757.11034-1-hsiangkao@linux.alibaba.com
Fixes: c5aa903a59db ("erofs: support reading chunk-based uncompressed files")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Diffstat (limited to 'fs/erofs')
| -rw-r--r-- | fs/erofs/inode.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c index 4408929bd6f5..31ac3a73b390 100644 --- a/fs/erofs/inode.c +++ b/fs/erofs/inode.c @@ -127,6 +127,7 @@ static struct page *erofs_read_inode(struct inode *inode, /* fill chunked inode summary info */ vi->chunkformat = le16_to_cpu(die->i_u.c.format); kfree(copied); + copied = NULL; break; case EROFS_INODE_LAYOUT_COMPACT: vi->inode_isize = sizeof(struct erofs_inode_compact); |