btrfs: add the missing error handling inside get_canonical_dev_path

Inside function get_canonical_dev_path(), we call d_path() to get the
final device path.

But d_path() can return error, and in that case the next strscpy() call
will trigger an invalid memory access.

Add back the missing error handling for d_path().

Reported-by: Boris Burkov <boris@bur.io>
Fixes: 7e06de7c83a7 ("btrfs: canonicalize the device path before adding it")
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 1cccaf9c2b0d5d4029440c46a4a92c7d6541d474..3d0ac8bdb21fe4a62c5cd5c85fb60373fb4473f4 100644 (file)
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -797,6 +797,10 @@ static int get_canonical_dev_path(const char *dev_path, char *canonical)
        if (ret)
                goto out;
        resolved_path = d_path(&path, path_buf, PATH_MAX);
+       if (IS_ERR(resolved_path)) {
+               ret = PTR_ERR(resolved_path);
+               goto out;
+       }
        ret = strscpy(canonical, resolved_path, PATH_MAX);
 out:
        kfree(path_buf);