From: Gao Xiang <hsiangkao@linux.alibaba.com> anolis inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB5UKT Reference: https://gitee.com/anolis/cloud-kernel/commit/6dcb63ca8ce52fb63d736624f9b8e01... -------------------------------- ANBZ: #1666 commit 1266b4a7ecb679587dc4d098abe56ea53313d569 upstream. Dan reported a new smatch warning [1] "fs/erofs/inode.c:210 erofs_read_inode() error: double free of 'copied'" Due to new chunk-based format handling logic, the error path can be called after kfree(copied). Set "copied = NULL" after kfree(copied) to fix this. [1] https://lore.kernel.org/r/202108251030.bELQozR7-lkp@intel.com Link: https://lore.kernel.org/r/20210825120757.11034-1-hsiangkao@linux.alibaba.com Fixes: c5aa903a59db ("erofs: support reading chunk-based uncompressed files") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> Signed-off-by: Huang Jianan <jnhuang@linux.alibaba.com> Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com> Reviewed-by: Jeffle Xu <jefflexu@linux.alibaba.com> Signed-off-by: Zizhi Wo <wozizhi@huawei.com> Signed-off-by: Baokun Li <libaokun1@huawei.com> --- fs/erofs/inode.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c index ec2f7aac1085..24b2e5da0893 100644 --- a/fs/erofs/inode.c +++ b/fs/erofs/inode.c @@ -127,6 +127,7 @@ static struct page *erofs_read_inode(struct inode *inode, /* fill chunked inode summary info */ vi->chunkformat = le16_to_cpu(die->i_u.c.format); kfree(copied); + copied = NULL; break; case EROFS_INODE_LAYOUT_COMPACT: vi->inode_isize = sizeof(struct erofs_inode_compact); -- 2.46.1