* [PATCH] ext4: Fix buffer_head refcnt leak when ext4_iget() fails
@ 2020-04-23 5:09 Xiyu Yang
2020-05-14 14:54 ` Theodore Y. Ts'o
0 siblings, 1 reply; 2+ messages in thread
From: Xiyu Yang @ 2020-04-23 5:09 UTC (permalink / raw)
To: Theodore Ts'o, Andreas Dilger, linux-ext4, linux-kernel
Cc: yuanxzhang, kjlu, Xiyu Yang, Xin Tan
ext4_orphan_get() invokes ext4_read_inode_bitmap(), which returns a
reference of the specified buffer_head object to "bitmap_bh" with
increased refcnt.
When ext4_orphan_get() returns, local variable "bitmap_bh" becomes
invalid, so the refcount should be decreased to keep refcount balanced.
The reference counting issue happens in one exception handling path of
ext4_orphan_get(). When ext4_iget() fails, the function forgets to
decrease the refcnt increased by ext4_read_inode_bitmap(), causing a
refcnt leak.
Fix this issue by calling brelse() when ext4_iget() fails.
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
---
fs/ext4/ialloc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index f95ee99091e4..2e4729ba17e6 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -1234,6 +1234,7 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
ext4_set_errno(sb, -err);
ext4_error(sb, "couldn't read orphan inode %lu (err %d)",
ino, err);
+ brelse(bitmap_bh);
return inode;
}
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ext4: Fix buffer_head refcnt leak when ext4_iget() fails
2020-04-23 5:09 [PATCH] ext4: Fix buffer_head refcnt leak when ext4_iget() fails Xiyu Yang
@ 2020-05-14 14:54 ` Theodore Y. Ts'o
0 siblings, 0 replies; 2+ messages in thread
From: Theodore Y. Ts'o @ 2020-05-14 14:54 UTC (permalink / raw)
To: Xiyu Yang
Cc: Andreas Dilger, linux-ext4, linux-kernel, yuanxzhang, kjlu, Xin Tan
On Thu, Apr 23, 2020 at 01:09:27PM +0800, Xiyu Yang wrote:
> ext4_orphan_get() invokes ext4_read_inode_bitmap(), which returns a
> reference of the specified buffer_head object to "bitmap_bh" with
> increased refcnt.
>
> When ext4_orphan_get() returns, local variable "bitmap_bh" becomes
> invalid, so the refcount should be decreased to keep refcount balanced.
>
> The reference counting issue happens in one exception handling path of
> ext4_orphan_get(). When ext4_iget() fails, the function forgets to
> decrease the refcnt increased by ext4_read_inode_bitmap(), causing a
> refcnt leak.
>
> Fix this issue by calling brelse() when ext4_iget() fails.
>
> Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Applied, thanks.
- Ted
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-05-14 14:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-23 5:09 [PATCH] ext4: Fix buffer_head refcnt leak when ext4_iget() fails Xiyu Yang
2020-05-14 14:54 ` Theodore Y. Ts'o
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).