[Ocfs2-devel] freeing memory allocated in security_inode_init_security()

[Ocfs2-devel] freeing memory allocated in security_inode_init_security()

[Mimi Zohar]

Hi,

Although it isn't documented in security.c, the LSM
security_inode_init_security() hook allocates memory for xattr name and
value, expecting the caller to release the memory afterwards.

I'm making my way through the different filesystems adding a subsequent
call to evm_inode_post_init_security().  I see the call to
ocfs2_init_security_and_acl() calls ocfs2_init_security_get(), which in
turn calls security_inode_init_security(), but am having a hard time
finding where the name and value are subsequently freed.  Would
appreciate if someone could point it out.

thanks,

Mimi

[Ocfs2-devel] freeing memory allocated in security_inode_init_security()

[Sunil Mushran]

On 05/04/2011 12:18 PM, Mimi Zohar wrote:
> Although it isn't documented in security.c, the LSM
> security_inode_init_security() hook allocates memory for xattr name and
> value, expecting the caller to release the memory afterwards.
>
> I'm making my way through the different filesystems adding a subsequent
> call to evm_inode_post_init_security().  I see the call to
> ocfs2_init_security_and_acl() calls ocfs2_init_security_get(), which in
> turn calls security_inode_init_security(), but am having a hard time
> finding where the name and value are subsequently freed.  Would
> appreciate if someone could point it out.

I think we have a leak in the reflink code path. mknod and symlink
code paths free the name/value pair.

Tiger, Please could you post a fix.

Re: [Ocfs2-devel] freeing memory allocated in security_inode_init_security()

[Mimi Zohar]

On Wed, 2011-05-04 at 15:18 -0400, Mimi Zohar wrote:
> Hi,
> 
> Although it isn't documented in security.c, the LSM
> security_inode_init_security() hook allocates memory for xattr name and
> value, expecting the caller to release the memory afterwards.
> 
> I'm making my way through the different filesystems adding a subsequent
> call to evm_inode_post_init_security().  I see the call to
> ocfs2_init_security_and_acl() calls ocfs2_init_security_get(), which in
> turn calls security_inode_init_security(), but am having a hard time
> finding where the name and value are subsequently freed.  Would
> appreciate if someone could point it out.
> 
> thanks,
> 
> Mimi

Although the reiserfs_security_init() comment explicitly states that the
caller must call reiserfs_security_free(), I don't see it being done.

Mimi

[Ocfs2-devel] freeing memory allocated in security_inode_init_security()

[Tiger Yang]

On 05/05/2011 04:09 AM, Sunil Mushran wrote:
> On 05/04/2011 12:18 PM, Mimi Zohar wrote:
>> Although it isn't documented in security.c, the LSM
>> security_inode_init_security() hook allocates memory for xattr name and
>> value, expecting the caller to release the memory afterwards.
>>
>> I'm making my way through the different filesystems adding a subsequent
>> call to evm_inode_post_init_security().  I see the call to
>> ocfs2_init_security_and_acl() calls ocfs2_init_security_get(), which in
>> turn calls security_inode_init_security(), but am having a hard time
>> finding where the name and value are subsequently freed.  Would
>> appreciate if someone could point it out.
>
> I think we have a leak in the reflink code path. mknod and symlink
> code paths free the name/value pair.
>
> Tiger, Please could you post a fix.
Hi, Mimi and Sunil,

I send a patch to fix this memory leak.

Thanks,
tiger