2020-05-27 23:07:59

by Qiushi Wu

Subject: [PATCH V2] nilfs2: Fix reference count leak in nilfs_sysfs_create_device_group

From: Qiushi Wu <[email protected]>

kobject_init_and_add() takes reference even when it fails.
In nilfs_sysfs_create_device_group(), the memory allocated by
kobject_init_and_add() is not freed when kobject_init_and_add()
fails. Fix this issue by calling kobject_put() to clean up the
kobject.

Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/<device> group")
Signed-off-by: Qiushi Wu <[email protected]>
---
V2: using kobject_put() to handle kobject_init_and_add() instead of
kobject_del().

fs/nilfs2/sysfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index e60be7bb55b0..8416f915d118 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -999,8 +999,10 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
init_completion(&nilfs->ns_dev_kobj_unregister);
err = kobject_init_and_add(&nilfs->ns_dev_kobj, &nilfs_dev_ktype, NULL,
"%s", sb->s_id);
- if (err)
+ if (err) {
+ kobject_put(&nilfs->ns_dev_kobj);
goto free_dev_subgroups;
+ }

err = nilfs_sysfs_create_mounted_snapshots_group(nilfs);
if (err)
--
2.17.1

2020-05-27 23:27:09

by Ryusuke Konishi

Subject: Re: [PATCH V2] nilfs2: Fix reference count leak in nilfs_sysfs_create_device_group

Hi Andrew,

Please pick this up as well.

Acked-by: Ryusuke Konishi <[email protected]>

On Thu, May 28, 2020 at 8:04 AM <[email protected]> wrote:
>
> From: Qiushi Wu <[email protected]>
>
> kobject_init_and_add() takes reference even when it fails.
> In nilfs_sysfs_create_device_group(), the memory allocated by
> kobject_init_and_add() is not freed when kobject_init_and_add()
> fails. Fix this issue by calling kobject_put() to clean up the
> kobject.
>
> Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/<device> group")
> Signed-off-by: Qiushi Wu <[email protected]>
> ---
> V2: using kobject_put() to handle kobject_init_and_add() instead of
> kobject_del().
>
> fs/nilfs2/sysfs.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
> index e60be7bb55b0..8416f915d118 100644
> --- a/fs/nilfs2/sysfs.c
> +++ b/fs/nilfs2/sysfs.c
> @@ -999,8 +999,10 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
> init_completion(&nilfs->ns_dev_kobj_unregister);
> err = kobject_init_and_add(&nilfs->ns_dev_kobj, &nilfs_dev_ktype, NULL,
> "%s", sb->s_id);
> - if (err)
> + if (err) {
> + kobject_put(&nilfs->ns_dev_kobj);
> goto free_dev_subgroups;
> + }
>
> err = nilfs_sysfs_create_mounted_snapshots_group(nilfs);
> if (err)
> --
> 2.17.1
>

2020-05-27 23:39:06

by Ryusuke Konishi

Subject: Re: [PATCH V2] nilfs2: Fix reference count leak in nilfs_sysfs_create_device_group

Hi Andrew,

This v2 patch was not CC'ed to you. Could you please
pick it up from LKML?

Regards,
Ryusuke Konishi

On Thu, May 28, 2020 at 8:23 AM Ryusuke Konishi
<[email protected]> wrote:
>
> Hi Andrew,
>
> Please pick this up as well.
>
> Acked-by: Ryusuke Konishi <[email protected]>
>
> On Thu, May 28, 2020 at 8:04 AM <[email protected]> wrote:
> >
> > From: Qiushi Wu <[email protected]>
> >
> > kobject_init_and_add() takes reference even when it fails.
> > In nilfs_sysfs_create_device_group(), the memory allocated by
> > kobject_init_and_add() is not freed when kobject_init_and_add()
> > fails. Fix this issue by calling kobject_put() to clean up the
> > kobject.
> >
> > Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/<device> group")
> > Signed-off-by: Qiushi Wu <[email protected]>
> > ---
> > V2: using kobject_put() to handle kobject_init_and_add() instead of
> > kobject_del().
> >
> > fs/nilfs2/sysfs.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
> > index e60be7bb55b0..8416f915d118 100644
> > --- a/fs/nilfs2/sysfs.c
> > +++ b/fs/nilfs2/sysfs.c
> > @@ -999,8 +999,10 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
> > init_completion(&nilfs->ns_dev_kobj_unregister);
> > err = kobject_init_and_add(&nilfs->ns_dev_kobj, &nilfs_dev_ktype, NULL,
> > "%s", sb->s_id);
> > - if (err)
> > + if (err) {
> > + kobject_put(&nilfs->ns_dev_kobj);
> > goto free_dev_subgroups;
> > + }
> >
> > err = nilfs_sysfs_create_mounted_snapshots_group(nilfs);
> > if (err)
> > --
> > 2.17.1
> >