Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751333AbdC0REm (ORCPT ); Mon, 27 Mar 2017 13:04:42 -0400 Received: from shells.gnugeneration.com ([66.240.222.126]:52320 "EHLO shells.gnugeneration.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751511AbdC0REh (ORCPT ); Mon, 27 Mar 2017 13:04:37 -0400 Date: Mon, 27 Mar 2017 10:05:34 -0700 From: Vito Caputo To: hughd@google.com Cc: linux-kernel , linux-mm@kvack.org Subject: [PATCH] shmem: fix __shmem_file_setup error path leaks Message-ID: <20170327170534.GA16903@shells.gnugeneration.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1918 Lines: 67 The existing path and memory cleanups appear to be in reverse order, and there's no iput() potentially leaking the inode in the last two error gotos. Also make put_memory shmem_unacct_size() conditional on !inode since if we entered cleanup at put_inode, shmem_evict_inode() occurs via iput()->iput_final(), which performs the shmem_unacct_size() for us. Signed-off-by: Vito Caputo --- This caught my eye while looking through the memfd_create() implementation. Included patch was compile tested only... mm/shmem.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/mm/shmem.c b/mm/shmem.c index e67d6ba..a1a84eaf 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -4134,7 +4134,7 @@ static struct file *__shmem_file_setup(const char *name, loff_t size, unsigned long flags, unsigned int i_flags) { struct file *res; - struct inode *inode; + struct inode *inode = NULL; struct path path; struct super_block *sb; struct qstr this; @@ -4162,7 +4162,7 @@ static struct file *__shmem_file_setup(const char *name, loff_t size, res = ERR_PTR(-ENOSPC); inode = shmem_get_inode(sb, NULL, S_IFREG | S_IRWXUGO, 0, flags); if (!inode) - goto put_memory; + goto put_path; inode->i_flags |= i_flags; d_instantiate(path.dentry, inode); @@ -4170,19 +4170,22 @@ static struct file *__shmem_file_setup(const char *name, loff_t size, clear_nlink(inode); /* It is unlinked */ res = ERR_PTR(ramfs_nommu_expand_for_mapping(inode, size)); if (IS_ERR(res)) - goto put_path; + goto put_inode; res = alloc_file(&path, FMODE_WRITE | FMODE_READ, &shmem_file_operations); if (IS_ERR(res)) - goto put_path; + goto put_inode; return res; -put_memory: - shmem_unacct_size(flags, size); +put_inode: + iput(inode); put_path: path_put(&path); +put_memory: + if (!inode) + shmem_unacct_size(flags, size); return res; } -- 2.1.4