2018-02-21 20:42:39

by Garry McNulty

Subject: [PATCH] fs/iomap: fix memory leak on error condition

If the call to is_sync_kiocb() fails an error is returned without
freeing dio. Set the return code and jump to out_free_dio.

Detected by CoverityScan, CID 1429424 ("Resource leak")

Signed-off-by: Garry McNulty <[email protected]>
---
fs/iomap.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/iomap.c b/fs/iomap.c
index afd163586aa0..65c5db38c15a 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -1063,8 +1063,10 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
iomap_dio_set_error(dio, ret);

if (!atomic_dec_and_test(&dio->ref)) {
- if (!is_sync_kiocb(iocb))
- return -EIOCBQUEUED;
+ if (!is_sync_kiocb(iocb)) {
+ ret = -EIOCBQUEUED;
+ goto out_free_dio;
+ }

for (;;) {
set_current_state(TASK_UNINTERRUPTIBLE);
--
2.14.3

2018-02-21 21:58:39

by Dave Chinner

Subject: Re: [PATCH] fs/iomap: fix memory leak on error condition

On Wed, Feb 21, 2018 at 08:41:28PM +0000, Garry McNulty wrote:
> If the call to is_sync_kiocb() fails an error is returned without
> freeing dio. Set the return code and jump to out_free_dio.
>
> Detected by CoverityScan, CID 1429424 ("Resource leak")

Coverity is wrong.

> Signed-off-by: Garry McNulty <[email protected]>
> ---
> fs/iomap.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/fs/iomap.c b/fs/iomap.c
> index afd163586aa0..65c5db38c15a 100644
> --- a/fs/iomap.c
> +++ b/fs/iomap.c
> @@ -1063,8 +1063,10 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
> iomap_dio_set_error(dio, ret);
>
> if (!atomic_dec_and_test(&dio->ref)) {
> - if (!is_sync_kiocb(iocb))
> - return -EIOCBQUEUED;
> + if (!is_sync_kiocb(iocb)) {
> + ret = -EIOCBQUEUED;
> + goto out_free_dio;
> + }

This is where we return after AIO submission. The struct dio has
already been attached to the bio we have submitted, and will be
freed on IO completion. We are simply not waiting for IO completion
here, instead leaving it to the completion code to free the struct
dio and pass the completion status to the AIO code appropriately.

Cheers,

Dave.
--
Dave Chinner
[email protected]

2018-02-21 23:13:58

by Garry McNulty

Subject: Re: [PATCH] fs/iomap: fix memory leak on error condition

On 21 February 2018 at 21:56, Dave Chinner <[email protected]> wrote:
>
> On Wed, Feb 21, 2018 at 08:41:28PM +0000, Garry McNulty wrote:
> > If the call to is_sync_kiocb() fails an error is returned without
> > freeing dio. Set the return code and jump to out_free_dio.
> >
> > Detected by CoverityScan, CID 1429424 ("Resource leak")
>
> Coverity is wrong.
>
> > Signed-off-by: Garry McNulty <[email protected]>
> > ---
> > fs/iomap.c | 6 ++++--
> > 1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/iomap.c b/fs/iomap.c
> > index afd163586aa0..65c5db38c15a 100644
> > --- a/fs/iomap.c
> > +++ b/fs/iomap.c
> > @@ -1063,8 +1063,10 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
> > iomap_dio_set_error(dio, ret);
> >
> > if (!atomic_dec_and_test(&dio->ref)) {
> > - if (!is_sync_kiocb(iocb))
> > - return -EIOCBQUEUED;
> > + if (!is_sync_kiocb(iocb)) {
> > + ret = -EIOCBQUEUED;
> > + goto out_free_dio;
> > + }
>
> This is where we return after AIO submission. The struct dio has
> already been attached to the bio we have submitted, and will be
> freed on IO completion. We are simply not waiting for IO completion
> here, instead leaving it to the completion code to free the struct
> dio and pass the completion status to the AIO code appropriately.
>
ah OK, thanks for reviewing and for the explanation.

Cheers

Garry