afs_select_fileserver() invokes afs_get_cb_interest(), which returns a
reference of the specified afs_cb_interest object to "fc->cbi" with
increased refcnt.
The reference counting issue happens in one exception handling path of
afs_select_fileserver(). When error occurred in
afs_wait_for_fs_probes(), the function forgets to decrease the refcnt
increased by afs_get_cb_interest(), causing a refcnt leak.
Fix this issue by calling afs_put_cb_interest() when error occurred in
afs_wait_for_fs_probes().
Signed-off-by: Xiyu Yang <[email protected]>
Signed-off-by: Xin Tan <[email protected]>
---
fs/afs/rotate.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c
index 2a3305e42b14..f73af16cdb92 100644
--- a/fs/afs/rotate.c
+++ b/fs/afs/rotate.c
@@ -357,8 +357,10 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc)
_debug("pick [%lx]", fc->untried);
error = afs_wait_for_fs_probes(fc->server_list, fc->untried);
- if (error < 0)
+ if (error < 0) {
+ afs_put_cb_interest(afs_v2net(vnode), fc->cbi);
goto failed_set_error;
+ }
/* Pick the untried server with the lowest RTT. If we have outstanding
* callbacks, we stick with the server we're already using if we can.
--
2.7.4
Xiyu Yang <[email protected]> wrote:
> error = afs_wait_for_fs_probes(fc->server_list, fc->untried);
> - if (error < 0)
> + if (error < 0) {
> + afs_put_cb_interest(afs_v2net(vnode), fc->cbi);
> goto failed_set_error;
> + }
Ummm... Did you try this? afs_end_vnode_operation() should then cause a
double free because you don't clear fc->cbi.
You can try it by installing the kafs-client package if your distribution has
it available and starting the afs.mount service or doing:
mount -t afs none /afs -o dyn
and then:
ls /afs/grand.central.org/
David