Skip to content

Commit d815b3f

Browse files
Dan Carpenterkdave
authored andcommitted
btrfs: fix error pointer dereference in btrfs_ioctl_rm_dev_v2()
If memdup_user() fails the error handing will crash when it tries to kfree() an error pointer. Just return directly because there is no cleanup required. Fixes: 1a15eb7 ("btrfs: use btrfs_get_dev_args_from_path in dev removal ioctls") Reviewed-by: Josef Bacik <[email protected]> Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: David Sterba <[email protected]> Signed-off-by: David Sterba <[email protected]>
1 parent daf87e9 commit d815b3f

File tree

1 file changed

+2
-4
lines changed

1 file changed

+2
-4
lines changed

fs/btrfs/ioctl.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3188,10 +3188,8 @@ static long btrfs_ioctl_rm_dev_v2(struct file *file, void __user *arg)
31883188
return -EPERM;
31893189

31903190
vol_args = memdup_user(arg, sizeof(*vol_args));
3191-
if (IS_ERR(vol_args)) {
3192-
ret = PTR_ERR(vol_args);
3193-
goto out;
3194-
}
3191+
if (IS_ERR(vol_args))
3192+
return PTR_ERR(vol_args);
31953193

31963194
if (vol_args->flags & ~BTRFS_DEVICE_REMOVE_ARGS_MASK) {
31973195
ret = -EOPNOTSUPP;

0 commit comments

Comments
 (0)