Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755641Ab2BFUoQ (ORCPT ); Mon, 6 Feb 2012 15:44:16 -0500 Received: from swampdragon.chaosbits.net ([90.184.90.115]:12287 "EHLO swampdragon.chaosbits.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754803Ab2BFUoP (ORCPT ); Mon, 6 Feb 2012 15:44:15 -0500 Date: Mon, 6 Feb 2012 21:44:45 +0100 (CET) From: Jesper Juhl To: Dave Chinner cc: xfs@oss.sgi.com, xfs-masters@oss.sgi.com, linux-kernel@vger.kernel.org, Ben Myers , Alex Elder , Raghavendra D Prabhu Subject: Re: [PATCH][RFC] XFS: Fix mem leak and possible NULL deref in xfs_setattr_nonsize() In-Reply-To: <20120206062319.GB12836@dastard> Message-ID: References: <20120206062319.GB12836@dastard> User-Agent: Alpine 2.00 (LNX 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2771 Lines: 85 On Mon, 6 Feb 2012, Dave Chinner wrote: > On Sun, Feb 05, 2012 at 10:23:44PM +0100, Jesper Juhl wrote: > > In xfs_setattr_nonsize(), xfs_trans_alloc() gets its memory from > > _xfs_trans_alloc() which gets it from kmem_zone_zalloc() which may > > fail and return NULL. So this: > > > > tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE); > > > > may result in a NULL 'tp'. > > If it does, then the call: > > > > error = xfs_trans_reserve(tp, 0, XFS_ICHANGE_LOG_RES(mp), 0, 0, 0); > > > > with a NULL 'tp' will explode, since xfs_trans_reserve() dereferences > > its first argument unconditionally. > > xfs_trans_alloc() can't fail. It will sleep forever until the memory > allocation succeeds. > > There's 35 other places in XFS where this xfs_trans_alloc/ > xfs_trans_reserve pattern occurs - none of them check whether tp is > null, either. > > > And if the memory allocation for 'tp' goes well (and thus > > xfs_trans_reserve() does not explode) then we may leak the memory > > allocated to 'tp' if xfs_trans_reserve() returns error. > > yes, that's a problem, though will only happen if a filesystem > shutdown occurs between the start of the function and that check. > > > > > I believe this patch should fix both issues, but I'm not intimate with > > the XFS code at all, so there can easily be something I overlooked or > > something that should be done differently than what I did. > > Only need to fix the leak of tp. > Ok. Thank you for the detailed explanation. I believe the patch below should do the trick. From: Jesper Juhl Date: Sun, 5 Feb 2012 22:11:30 +0100 Subject: [PATCH] XFS: Fix mem leak in xfs_setattr_nonsize() If the memory allocation for 'tp' goes well then we will leak the memory allocated to 'tp' if xfs_trans_reserve() returns error. Signed-off-by: Jesper Juhl --- fs/xfs/xfs_iops.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c index ab30253..2fc1600 100644 --- a/fs/xfs/xfs_iops.c +++ b/fs/xfs/xfs_iops.c @@ -576,8 +576,10 @@ xfs_setattr_nonsize( tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE); error = xfs_trans_reserve(tp, 0, XFS_ICHANGE_LOG_RES(mp), 0, 0, 0); - if (error) + if (error) { + xfs_trans_cancel(tp, 0); goto out_dqrele; + } xfs_ilock(ip, XFS_ILOCK_EXCL); -- 1.7.9 -- Jesper Juhl http://www.chaosbits.net/ Don't top-post http://www.catb.org/jargon/html/T/top-post.html Plain text mails only, please. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/