Hi,
In omfs_fill_super(), when returning on error, sbi is not being freed.
Thanks,
Davidlohr.
Signed-off-by: Davidlohr Bueso <[email protected]>
---
fs/omfs/inode.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
index 089839a..253846e 100644
--- a/fs/omfs/inode.c
+++ b/fs/omfs/inode.c
@@ -523,12 +523,14 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent)
}
printk(KERN_DEBUG "omfs: Mounted volume %s\n", omfs_rb->r_name);
- ret = 0;
+ ret = 0; /* success */
out_brelse_bh2:
brelse(bh2);
out_brelse_bh:
brelse(bh);
end:
+ if (ret != 0)
+ kfree(sbi);
return ret;
}
--
1.7.0.4
On Sat, Jul 03, 2010 at 10:33:48PM -0400, Davidlohr Bueso wrote:
> Hi,
>
> In omfs_fill_super(), when returning on error, sbi is not being freed.
>
> Thanks,
> Davidlohr.
Hi Davidlohr,
I don't think this is right:
fill_super:
err = omfs_fill_super()
if (err)
deactivate_locked_super(sb)
kill_sb()
generic_shutdown_super()
sop->put_super()
...
omfs_put_super()
kfree(sbi->s_imap);
kfree(sbi);
So your change would cause a crash at the first kfree in omfs_put_super().
It looks fine to me as-is, or am I missing something?
>
> Signed-off-by: Davidlohr Bueso <[email protected]>
> ---
> fs/omfs/inode.c | 4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)
>
> diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
> index 089839a..253846e 100644
> --- a/fs/omfs/inode.c
> +++ b/fs/omfs/inode.c
> @@ -523,12 +523,14 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent)
> }
> printk(KERN_DEBUG "omfs: Mounted volume %s\n", omfs_rb->r_name);
>
> - ret = 0;
> + ret = 0; /* success */
> out_brelse_bh2:
> brelse(bh2);
> out_brelse_bh:
> brelse(bh);
> end:
> + if (ret != 0)
> + kfree(sbi);
> return ret;
> }
--
Bob Copeland %% http://www.bobcopeland.com
On Sun, 2010-07-04 at 07:37 -0400, [email protected] wrote:
> On Sat, Jul 03, 2010 at 10:33:48PM -0400, Davidlohr Bueso wrote:
> > Hi,
> >
> > In omfs_fill_super(), when returning on error, sbi is not being freed.
> >
> > Thanks,
> > Davidlohr.
>
> Hi Davidlohr,
>
> I don't think this is right:
>
> fill_super:
> err = omfs_fill_super()
> if (err)
> deactivate_locked_super(sb)
> kill_sb()
> generic_shutdown_super()
> sop->put_super()
> ...
> omfs_put_super()
> kfree(sbi->s_imap);
> kfree(sbi);
>
> So your change would cause a crash at the first kfree in omfs_put_super().
>
> It looks fine to me as-is, or am I missing something?
Thanks for the reply, Bob. Please bare with me, as I am learning about
the VFS workings. To my knowledge this would happen:
a user tries to mount a omfs partition:
omfs_get_sb() -> omfs_fill_super()
If omfs_fill_super() fails, in this case 'ret' being a non 0 value, the
mount will not be completed, hence the previously allocated 'sbi'
variable will not be freed.
Isn't put_super() called to free data when things run "normally", like
for unmounting? So this function does two things:
kfree(sbi->s_imap)
kfree(sbi)
However, in omfs_get_imap() 'sbi->s_imap' is freed upon failure, so
wouldn't this also crash on the first kfree in omfs_put_super()?
Wouldn't this be the same for freeing sbi upon failure in
omfs_fill_super()?
Now, the patch I sent is compile-tested only, so it might crash it. I
will test it properly.
If what I just said is complete nonsense, please enlighten me.
Thanks,
Davidlohr
>
> >
> > Signed-off-by: Davidlohr Bueso <[email protected]>
> > ---
> > fs/omfs/inode.c | 4 +++-
> > 1 files changed, 3 insertions(+), 1 deletions(-)
> >
> > diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
> > index 089839a..253846e 100644
> > --- a/fs/omfs/inode.c
> > +++ b/fs/omfs/inode.c
> > @@ -523,12 +523,14 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent)
> > }
> > printk(KERN_DEBUG "omfs: Mounted volume %s\n", omfs_rb->r_name);
> >
> > - ret = 0;
> > + ret = 0; /* success */
> > out_brelse_bh2:
> > brelse(bh2);
> > out_brelse_bh:
> > brelse(bh);
> > end:
> > + if (ret != 0)
> > + kfree(sbi);
> > return ret;
> > }
>
On Mon, Jul 05, 2010 at 01:12:39AM -0400, Davidlohr Bueso wrote:
> Isn't put_super() called to free data when things run "normally", like
> for unmounting? So this function does two things:
Ok, I checked it out and you are right, FS put_super is only called
after successful mount so there is a leak. I'll take your patch,
but please:
- remove the /* success */ comment, IMO it's just noise
- write the if conditional as the more usual:
if (ret)
> kfree(sbi->s_imap)
> kfree(sbi)
>
> However, in omfs_get_imap() 'sbi->s_imap' is freed upon failure, so
> wouldn't this also crash on the first kfree in omfs_put_super()?
This is ok, since sbi->s_imap is set to null in that case and
kfree(NULL) is fine.
Thanks for the review!
--
Bob Copeland %% http://www.bobcopeland.com
On Mon, 2010-07-05 at 10:00 -0400, [email protected] wrote:
> On Mon, Jul 05, 2010 at 01:12:39AM -0400, Davidlohr Bueso wrote:
> > Isn't put_super() called to free data when things run "normally", like
> > for unmounting? So this function does two things:
>
> Ok, I checked it out and you are right, FS put_super is only called
> after successful mount so there is a leak. I'll take your patch,
> but please:
>
> - remove the /* success */ comment, IMO it's just noise
> - write the if conditional as the more usual:
> if (ret)
>
Ok, resending that patch with the corrections. Thanks.
Signed-off-by: Davidlohr Bueso <[email protected]>
---
fs/omfs/inode.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
index 089839a..b5d6380 100644
--- a/fs/omfs/inode.c
+++ b/fs/omfs/inode.c
@@ -529,6 +529,8 @@ out_brelse_bh2:
out_brelse_bh:
brelse(bh);
end:
+ if (ret)
+ kfree(sbi);
return ret;
}
--
1.7.0.4
> > kfree(sbi->s_imap)
> > kfree(sbi)
> >
> > However, in omfs_get_imap() 'sbi->s_imap' is freed upon failure, so
> > wouldn't this also crash on the first kfree in omfs_put_super()?
>
> This is ok, since sbi->s_imap is set to null in that case and
> kfree(NULL) is fine.
>
> Thanks for the review!
>
On Tue, Jul 06, 2010 at 12:50:58AM -0400, Davidlohr Bueso wrote:
> Ok, resending that patch with the corrections. Thanks.
>
> Signed-off-by: Davidlohr Bueso <[email protected]>
Great, applied to the fixes branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bcopeland/omfs.git
Thanks!
--
Bob Copeland %% http://www.bobcopeland.com