Skip to content

Commit 74ee791

Browse files
adam900710kdave
authored andcommitted
btrfs: reset destination buffer when read_extent_buffer() gets invalid range
Commit f98b621 ("btrfs: extent_io: do extra check for extent buffer read write functions") changed how we handle invalid extent buffer range for read_extent_buffer(). Previously if the range is invalid we just set the destination to zero, but after the patch we do nothing and error out. This can lead to smatch static checker errors like: fs/btrfs/print-tree.c:186 print_uuid_item() error: uninitialized symbol 'subvol_id'. fs/btrfs/tests/extent-io-tests.c:338 check_eb_bitmap() error: uninitialized symbol 'has'. fs/btrfs/tests/extent-io-tests.c:353 check_eb_bitmap() error: uninitialized symbol 'has'. fs/btrfs/uuid-tree.c:203 btrfs_uuid_tree_remove() error: uninitialized symbol 'read_subid'. fs/btrfs/uuid-tree.c:353 btrfs_uuid_tree_iterate() error: uninitialized symbol 'subid_le'. fs/btrfs/uuid-tree.c:72 btrfs_uuid_tree_lookup() error: uninitialized symbol 'data'. fs/btrfs/volumes.c:7415 btrfs_dev_stats_value() error: uninitialized symbol 'val'. Fix those warnings by reverting back to the old memset() behavior. By this we keep the static checker happy and would still make a lot of noise when such invalid ranges are passed in. Reported-by: Dan Carpenter <[email protected]> Fixes: f98b621 ("btrfs: extent_io: do extra check for extent buffer read write functions") Signed-off-by: Qu Wenruo <[email protected]> Signed-off-by: David Sterba <[email protected]>
1 parent 58bfe2c commit 74ee791

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

fs/btrfs/extent_io.c

+7-1
Original file line numberDiff line numberDiff line change
@@ -3995,8 +3995,14 @@ void read_extent_buffer(const struct extent_buffer *eb, void *dstv,
39953995
char *dst = (char *)dstv;
39963996
unsigned long i = get_eb_page_index(start);
39973997

3998-
if (check_eb_range(eb, start, len))
3998+
if (check_eb_range(eb, start, len)) {
3999+
/*
4000+
* Invalid range hit, reset the memory, so callers won't get
4001+
* some random garbage for their uninitialzed memory.
4002+
*/
4003+
memset(dstv, 0, len);
39994004
return;
4005+
}
40004006

40014007
offset = get_eb_offset_in_page(eb, start);
40024008

0 commit comments

Comments
 (0)