Re: [PATCH] btrfs: fix uninitialized pointer free on add_inode_ref

[David Sterba]

On Wed, Oct 09, 2024 at 10:08:33AM +0200, Roi Martin wrote:
> The "add_inode_ref" function does not initializes the "name" struct
> when it is declared.  If any of the following calls to
> "read_one_inode" returns NULL,
> 
> 	dir = read_one_inode(root, parent_objectid);
> 	if (!dir) {
> 		ret = -ENOENT;
> 		goto out;
> 	}
> 
> 	inode = read_one_inode(root, inode_objectid);
> 	if (!inode) {
> 		ret = -EIO;
> 		goto out;
> 	}
> 
> then "name.name" would be freed on "out" before being initialized.
> 
> out:
> 	...
> 	kfree(name.name);
> 
> This issue was reported by Coverity with CID 1526744.
> 
> Signed-off-by: Roi Martin <jroi.martin@xxxxxxxxx>

Reviewed-by: David Sterba <dsterba@xxxxxxxx>

Added to for-next, thanks.