2020-08-27 06:29:55

by Dinghao Liu

Subject: [PATCH] ext4: Fix memleak in add_new_gdb

When ext4_journal_get_write_access() fails, we should release
n_group_desc, iloc.bh, dind and gdb_bh to prevent memleak.
It's the same when ext4_handle_dirty_super() fails, but we
don't need to release dind here because it has been released
before.

Signed-off-by: Dinghao Liu <[email protected]>
---
fs/ext4/resize.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index a50b51270ea9..efc0a022ca8e 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -843,8 +843,10 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,

BUFFER_TRACE(dind, "get_write_access");
err = ext4_journal_get_write_access(handle, dind);
- if (unlikely(err))
+ if (unlikely(err)) {
ext4_std_error(sb, err);
+ goto errout;
+ }

/* ext4_reserve_inode_write() gets a reference on the iloc */
err = ext4_reserve_inode_write(handle, inode, &iloc);
@@ -899,13 +901,17 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,

le16_add_cpu(&es->s_reserved_gdt_blocks, -1);
err = ext4_handle_dirty_super(handle, sb);
- if (err)
+ if (err) {
ext4_std_error(sb, err);
+ goto errsuper;
+ }
+
return err;
errout:
+ brelse(dind);
+errsuper:
kvfree(n_group_desc);
brelse(iloc.bh);
- brelse(dind);
brelse(gdb_bh);

ext4_debug("leaving with error %d\n", err);
--
2.17.1

2020-08-28 09:21:52

by Jan Kara

Subject: Re: [PATCH] ext4: Fix memleak in add_new_gdb

On Thu 27-08-20 14:28:43, Dinghao Liu wrote:
> When ext4_journal_get_write_access() fails, we should release
> n_group_desc, iloc.bh, dind and gdb_bh to prevent memleak.
> It's the same when ext4_handle_dirty_super() fails, but we
> don't need to release dind here because it has been released
> before.
>
> Signed-off-by: Dinghao Liu <[email protected]>

Thanks for the patch! Some comments below:

> diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
> index a50b51270ea9..efc0a022ca8e 100644
> --- a/fs/ext4/resize.c
> +++ b/fs/ext4/resize.c
> @@ -843,8 +843,10 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
>
> BUFFER_TRACE(dind, "get_write_access");
> err = ext4_journal_get_write_access(handle, dind);
> - if (unlikely(err))
> + if (unlikely(err)) {
> ext4_std_error(sb, err);
> + goto errout;
> + }

This hunk looks good.

> @@ -899,13 +901,17 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
>
> le16_add_cpu(&es->s_reserved_gdt_blocks, -1);
> err = ext4_handle_dirty_super(handle, sb);
> - if (err)
> + if (err) {
> ext4_std_error(sb, err);
> + goto errsuper;
> + }
> +
> return err;
> errout:
> + brelse(dind);
> +errsuper:

But this is definitely wrong. Look, n_group_desc and gdb_bh are already
referenced from the superblock so you cannot free them, iloc.bh has been
released in ext4_mark_iloc_dirty().

Honza
--
Jan Kara <[email protected]>
SUSE Labs, CR

2020-08-29 02:33:58

by Dinghao Liu

Subject: Re: Re: [PATCH] ext4: Fix memleak in add_new_gdb

> On Thu 27-08-20 14:28:43, Dinghao Liu wrote:
> > When ext4_journal_get_write_access() fails, we should release
> > n_group_desc, iloc.bh, dind and gdb_bh to prevent memleak.
> > It's the same when ext4_handle_dirty_super() fails, but we
> > don't need to release dind here because it has been released
> > before.
> >
> > Signed-off-by: Dinghao Liu <[email protected]>
>
> Thanks for the patch! Some comments below:
>
> > diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
> > index a50b51270ea9..efc0a022ca8e 100644
> > --- a/fs/ext4/resize.c
> > +++ b/fs/ext4/resize.c
> > @@ -843,8 +843,10 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
> >
> > BUFFER_TRACE(dind, "get_write_access");
> > err = ext4_journal_get_write_access(handle, dind);
> > - if (unlikely(err))
> > + if (unlikely(err)) {
> > ext4_std_error(sb, err);
> > + goto errout;
> > + }
>
> This hunk looks good.
>
> > @@ -899,13 +901,17 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
> >
> > le16_add_cpu(&es->s_reserved_gdt_blocks, -1);
> > err = ext4_handle_dirty_super(handle, sb);
> > - if (err)
> > + if (err) {
> > ext4_std_error(sb, err);
> > + goto errsuper;
> > + }
> > +
> > return err;
> > errout:
> > + brelse(dind);
> > +errsuper:
>
> But this is definitely wrong. Look, n_group_desc and gdb_bh are already
> referenced from the superblock so you cannot free them, iloc.bh has been
> released in ext4_mark_iloc_dirty().
>

Thank you for your advice! It's clear to me and I will fix this soon.

Regards,
Dinghao