Commit 7b9ea627 authored by Shailendra Verma's avatar Shailendra Verma Committed by David Sterba
Browse files

btrfs: return early from failed memory allocations in ioctl handlers 



There is no need to call kfree() if memdup_user() fails, as no memory
was allocated and the error in the error-valued pointer should be returned.

Signed-off-by: default avatarShailendra Verma <shailendra.v@samsung.com>
[ edit subject ]
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 58e8012c

fs/btrfs/ioctl.c

+6 −15
Original line number Diff line number Diff line
@@ -4569,11 +4569,8 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_root *root, 
		return -EPERM;



	loi = memdup_user(arg, sizeof(*loi));

	if (IS_ERR(loi)) {

		ret = PTR_ERR(loi);

		loi = NULL;

		goto out;

	}

	if (IS_ERR(loi))

		return PTR_ERR(loi);



	path = btrfs_alloc_path();

	if (!path) {
@@ -5200,11 +5197,8 @@ static long btrfs_ioctl_set_received_subvol_32(struct file *file, 
	int ret = 0;



	args32 = memdup_user(arg, sizeof(*args32));

	if (IS_ERR(args32)) {

		ret = PTR_ERR(args32);

		args32 = NULL;

		goto out;

	}

	if (IS_ERR(args32))

		return PTR_ERR(args32);



	args64 = kmalloc(sizeof(*args64), GFP_KERNEL);

	if (!args64) {
@@ -5252,11 +5246,8 @@ static long btrfs_ioctl_set_received_subvol(struct file *file, 
	int ret = 0;



	sa = memdup_user(arg, sizeof(*sa));

	if (IS_ERR(sa)) {

		ret = PTR_ERR(sa);

		sa = NULL;

		goto out;

	}

	if (IS_ERR(sa))

		return PTR_ERR(sa);



	ret = _btrfs_ioctl_set_received_subvol(file, sa);

CRA Git | Maintained and supported by SUSTech CRA and CCSE