btrfs: add the missing error handling inside get_canonical_dev_path

fe4de594 · Qu Wenruo <[email protected]> · 2025-01-08 14:14:04 +10:30

Inside function get_canonical_dev_path(), we call d_path() to get the
final device path.

But d_path() can return error, and in that case the next strscpy() call
will trigger an invalid memory access.

Add back the missing error handling for d_path().

Reported-by: Boris Burkov <[email protected]>
Fixes: 7e06de7c83a7 ("btrfs: canonicalize the device path before adding it")
Signed-off-by: Qu Wenruo <[email protected]>
Signed-off-by: David Sterba <[email protected]>

Commit: fe4de594f7a2e9bc49407de60fbd20809fad4192
Parents: 0ee4736c

Changes

1 files changed · +4 −0

File	Status	Add	Del	Content
fs/btrfs/volumes.c	modified	+4	−0	View file

fs/btrfs/volumes.c

View file

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 1cccaf9..3d0ac8b 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -797,6 +797,10 @@ static int get_canonical_dev_path(const char *dev_path, char *canonical)
 	if (ret)
 		goto out;
 	resolved_path = d_path(&path, path_buf, PATH_MAX);
+	if (IS_ERR(resolved_path)) {
+		ret = PTR_ERR(resolved_path);
+		goto out;
+	}
 	ret = strscpy(canonical, resolved_path, PATH_MAX);
 out:
 	kfree(path_buf);