[PATCH 1/2] ubifs: xattr: Fix some potential memory leaks while iterating entries

[PATCH 1/2] ubifs: xattr: Fix some potential memory leaks while iterating entries

[Zhihao Cheng]

Fix some potential memory leaks in error handling branches while
iterating xattr entries. For example, function ubifs_tnc_remove_ino()
forgets to free pxent if it exists. Similar problems also exist in
ubifs_purge_xattrs(), ubifs_add_orphan() and ubifs_jnl_write_inode().

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: <Stable@vger.kernel.org>
Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")
---
 fs/ubifs/journal.c | 2 ++
 fs/ubifs/orphan.c  | 2 ++
 fs/ubifs/tnc.c     | 3 +++
 fs/ubifs/xattr.c   | 2 ++
 4 files changed, 9 insertions(+)

diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index e5ec1afe1c66..0b4b94b079a6 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -893,6 +893,7 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode)
 				if (err == -ENOENT)
 					break;
 
+				kfree(pxent);
 				goto out_release;
 			}
 
@@ -905,6 +906,7 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode)
 				ubifs_err(c, "dead directory entry '%s', error %d",
 					  xent->name, err);
 				ubifs_ro_mode(c, err);
+				kfree(pxent);
 				kfree(xent);
 				goto out_release;
 			}
diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
index 283f9eb48410..b0117878b3a0 100644
--- a/fs/ubifs/orphan.c
+++ b/fs/ubifs/orphan.c
@@ -173,6 +173,7 @@ int ubifs_add_orphan(struct ubifs_info *c, ino_t inum)
 			err = PTR_ERR(xent);
 			if (err == -ENOENT)
 				break;
+			kfree(pxent);
 			return err;
 		}
 
@@ -182,6 +183,7 @@ int ubifs_add_orphan(struct ubifs_info *c, ino_t inum)
 
 		xattr_orphan = orphan_add(c, xattr_inum, orphan);
 		if (IS_ERR(xattr_orphan)) {
+			kfree(pxent);
 			kfree(xent);
 			return PTR_ERR(xattr_orphan);
 		}
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index e8e7b0e9532e..33742ee3945b 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -2885,6 +2885,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum)
 			err = PTR_ERR(xent);
 			if (err == -ENOENT)
 				break;
+			kfree(pxent);
 			return err;
 		}
 
@@ -2898,6 +2899,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum)
 		fname_len(&nm) = le16_to_cpu(xent->nlen);
 		err = ubifs_tnc_remove_nm(c, &key1, &nm);
 		if (err) {
+			kfree(pxent);
 			kfree(xent);
 			return err;
 		}
@@ -2906,6 +2908,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum)
 		highest_ino_key(c, &key2, xattr_inum);
 		err = ubifs_tnc_remove_range(c, &key1, &key2);
 		if (err) {
+			kfree(pxent);
 			kfree(xent);
 			return err;
 		}
diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
index 9aefbb60074f..a0b9b349efe6 100644
--- a/fs/ubifs/xattr.c
+++ b/fs/ubifs/xattr.c
@@ -522,6 +522,7 @@ int ubifs_purge_xattrs(struct inode *host)
 				  xent->name, err);
 			ubifs_ro_mode(c, err);
 			kfree(pxent);
+			kfree(xent);
 			return err;
 		}
 
@@ -531,6 +532,7 @@ int ubifs_purge_xattrs(struct inode *host)
 		err = remove_xattr(c, host, xino, &nm);
 		if (err) {
 			kfree(pxent);
+			kfree(xent);
 			iput(xino);
 			ubifs_err(c, "cannot remove xattr, error %d", err);
 			return err;
-- 
2.25.4

[PATCH 1/2] ubifs: xattr: Fix some potential memory leaks while iterating entries

[Zhihao Cheng]

Fix some potential memory leaks in error handling branches while
iterating xattr entries. For example, function ubifs_tnc_remove_ino()
forgets to free pxent if it exists. Similar problems also exist in
ubifs_purge_xattrs(), ubifs_add_orphan() and ubifs_jnl_write_inode().

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: <Stable@vger.kernel.org>
Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")
---
 fs/ubifs/journal.c | 2 ++
 fs/ubifs/orphan.c  | 2 ++
 fs/ubifs/tnc.c     | 3 +++
 fs/ubifs/xattr.c   | 2 ++
 4 files changed, 9 insertions(+)

diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index e5ec1afe1c66..0b4b94b079a6 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -893,6 +893,7 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode)
 				if (err == -ENOENT)
 					break;
 
+				kfree(pxent);
 				goto out_release;
 			}
 
@@ -905,6 +906,7 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode)
 				ubifs_err(c, "dead directory entry '%s', error %d",
 					  xent->name, err);
 				ubifs_ro_mode(c, err);
+				kfree(pxent);
 				kfree(xent);
 				goto out_release;
 			}
diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
index 283f9eb48410..b0117878b3a0 100644
--- a/fs/ubifs/orphan.c
+++ b/fs/ubifs/orphan.c
@@ -173,6 +173,7 @@ int ubifs_add_orphan(struct ubifs_info *c, ino_t inum)
 			err = PTR_ERR(xent);
 			if (err == -ENOENT)
 				break;
+			kfree(pxent);
 			return err;
 		}
 
@@ -182,6 +183,7 @@ int ubifs_add_orphan(struct ubifs_info *c, ino_t inum)
 
 		xattr_orphan = orphan_add(c, xattr_inum, orphan);
 		if (IS_ERR(xattr_orphan)) {
+			kfree(pxent);
 			kfree(xent);
 			return PTR_ERR(xattr_orphan);
 		}
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index e8e7b0e9532e..33742ee3945b 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -2885,6 +2885,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum)
 			err = PTR_ERR(xent);
 			if (err == -ENOENT)
 				break;
+			kfree(pxent);
 			return err;
 		}
 
@@ -2898,6 +2899,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum)
 		fname_len(&nm) = le16_to_cpu(xent->nlen);
 		err = ubifs_tnc_remove_nm(c, &key1, &nm);
 		if (err) {
+			kfree(pxent);
 			kfree(xent);
 			return err;
 		}
@@ -2906,6 +2908,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum)
 		highest_ino_key(c, &key2, xattr_inum);
 		err = ubifs_tnc_remove_range(c, &key1, &key2);
 		if (err) {
+			kfree(pxent);
 			kfree(xent);
 			return err;
 		}
diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
index 9aefbb60074f..a0b9b349efe6 100644
--- a/fs/ubifs/xattr.c
+++ b/fs/ubifs/xattr.c
@@ -522,6 +522,7 @@ int ubifs_purge_xattrs(struct inode *host)
 				  xent->name, err);
 			ubifs_ro_mode(c, err);
 			kfree(pxent);
+			kfree(xent);
 			return err;
 		}
 
@@ -531,6 +532,7 @@ int ubifs_purge_xattrs(struct inode *host)
 		err = remove_xattr(c, host, xino, &nm);
 		if (err) {
 			kfree(pxent);
+			kfree(xent);
 			iput(xino);
 			ubifs_err(c, "cannot remove xattr, error %d", err);
 			return err;
-- 
2.25.4


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH 2/2] ubifs: dent: Fix some potential memory leaks while iterating entries

[Zhihao Cheng]

Fix some potential memory leaks in error handling branches while
iterating dent entries. For example, function dbg_check_dir()
forgets to free pdent if it exists.

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: <Stable@vger.kernel.org>
Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")
---
 fs/ubifs/debug.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 0f5a480fe264..b4a3abf54df7 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -1123,6 +1123,7 @@ int dbg_check_dir(struct ubifs_info *c, const struct inode *dir)
 			err = PTR_ERR(dent);
 			if (err == -ENOENT)
 				break;
+			kfree(pdent);
 			return err;
 		}
 
-- 
2.25.4

[PATCH 2/2] ubifs: dent: Fix some potential memory leaks while iterating entries

[Zhihao Cheng]

Fix some potential memory leaks in error handling branches while
iterating dent entries. For example, function dbg_check_dir()
forgets to free pdent if it exists.

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: <Stable@vger.kernel.org>
Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")
---
 fs/ubifs/debug.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 0f5a480fe264..b4a3abf54df7 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -1123,6 +1123,7 @@ int dbg_check_dir(struct ubifs_info *c, const struct inode *dir)
 			err = PTR_ERR(dent);
 			if (err == -ENOENT)
 				break;
+			kfree(pdent);
 			return err;
 		}
 
-- 
2.25.4


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH 1/2] ubifs: xattr: Fix some potential memory leaks while iterating entries

[Richard Weinberger]

On Mon, Jun 1, 2020 at 11:11 AM Zhihao Cheng <chengzhihao1@huawei.com> wrote:
>
> Fix some potential memory leaks in error handling branches while
> iterating xattr entries. For example, function ubifs_tnc_remove_ino()
> forgets to free pxent if it exists. Similar problems also exist in
> ubifs_purge_xattrs(), ubifs_add_orphan() and ubifs_jnl_write_inode().
>
> Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
> Cc: <Stable@vger.kernel.org>
> Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")

I agree that this needs fixing. Did you also look into getting rid of pxent?
UBIFS uses the pxent pattern over and over and the same error got copy pasted
a lot. :-(

-- 
Thanks,
//richard

Re: [PATCH 1/2] ubifs: xattr: Fix some potential memory leaks while iterating entries

[Richard Weinberger]

On Mon, Jun 1, 2020 at 11:11 AM Zhihao Cheng <chengzhihao1@huawei.com> wrote:
>
> Fix some potential memory leaks in error handling branches while
> iterating xattr entries. For example, function ubifs_tnc_remove_ino()
> forgets to free pxent if it exists. Similar problems also exist in
> ubifs_purge_xattrs(), ubifs_add_orphan() and ubifs_jnl_write_inode().
>
> Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
> Cc: <Stable@vger.kernel.org>
> Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")

I agree that this needs fixing. Did you also look into getting rid of pxent?
UBIFS uses the pxent pattern over and over and the same error got copy pasted
a lot. :-(

-- 
Thanks,
//richard

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH 1/2] ubifs: xattr: Fix some potential memory leaks while iterating entries

[Zhihao Cheng]

在 2020/9/14 3:08, Richard Weinberger 写道:
> On Mon, Jun 1, 2020 at 11:11 AM Zhihao Cheng <chengzhihao1@huawei.com> wrote:
>>

> I agree that this needs fixing. Did you also look into getting rid of pxent?
> UBIFS uses the pxent pattern over and over and the same error got copy pasted
> a lot. :-(
> 
I thought about it. I'm not sure whether it is good to drop 'pxent'. 
Maybe you mean doing changes looks like following(Takes 
ubifs_jnl_write_inode() for example):

diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index 4a5b06f8d812..fcd5ac047b34 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -879,13 +879,19 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, 
const struct inode *inode)
  		union ubifs_key key;
  		struct fscrypt_name nm = {0};
  		struct inode *xino;
-		struct ubifs_dent_node *xent, *pxent = NULL;
+		struct ubifs_dent_node *xent;

  		if (ui->xattr_cnt >= ubifs_xattr_max_cnt(c)) {
  			ubifs_err(c, "Cannot delete inode, it has too much xattrs!");
  			goto out_release;
  		}

+		fname_name(&nm) = kmalloc(UBIFS_MAX_NLEN, GFP_NOFS);
+		if (!fname_name(&nm)) {
+			err = -ENOMEM;
+			goto out_release;
+		}
+
  		lowest_xent_key(c, &key, inode->i_ino);
  		while (1) {
  			xent = ubifs_tnc_next_ent(c, &key, &nm);
@@ -894,11 +900,12 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, 
const struct inode *inode)
  				if (err == -ENOENT)
  					break;

+				kfree(fname_name(&nm));
  				goto out_release;
  			}

-			fname_name(&nm) = xent->name;
  			fname_len(&nm) = le16_to_cpu(xent->nlen);
+			strncpy(fname_name(&nm), xent->name, fname_len(&nm));

  			xino = ubifs_iget(c->vfs_sb, le64_to_cpu(xent->inum));
  			if (IS_ERR(xino)) {
@@ -907,6 +914,7 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, 
const struct inode *inode)
  					  xent->name, err);
  				ubifs_ro_mode(c, err);
  				kfree(xent);
+				kfree(fname_name(&nm));
  				goto out_release;
  			}
  			ubifs_assert(c, ubifs_inode(xino)->xattr);
@@ -916,11 +924,10 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, 
const struct inode *inode)
  			ino = (void *)ino + UBIFS_INO_NODE_SZ;
  			iput(xino);

-			kfree(pxent);
-			pxent = xent;
  			key_read(c, &xent->key, &key);
+			kfree(xent);
  		}
-		kfree(pxent);
+		kfree(fname_name(&nm));
  	}

  	pack_inode(c, ino, inode, 1);

The kill_xattrs process is more intuitive without the pxent. However, 
the release process for the memory (stores xent->name) is similar to 
'pxent'. If you think it's better than v1, I will send v2.

Re: [PATCH 1/2] ubifs: xattr: Fix some potential memory leaks while iterating entries

[Zhihao Cheng]

在 2020/9/14 3:08, Richard Weinberger 写道:
> On Mon, Jun 1, 2020 at 11:11 AM Zhihao Cheng <chengzhihao1@huawei.com> wrote:
>>

> I agree that this needs fixing. Did you also look into getting rid of pxent?
> UBIFS uses the pxent pattern over and over and the same error got copy pasted
> a lot. :-(
> 
I thought about it. I'm not sure whether it is good to drop 'pxent'. 
Maybe you mean doing changes looks like following(Takes 
ubifs_jnl_write_inode() for example):

diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index 4a5b06f8d812..fcd5ac047b34 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -879,13 +879,19 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, 
const struct inode *inode)
  		union ubifs_key key;
  		struct fscrypt_name nm = {0};
  		struct inode *xino;
-		struct ubifs_dent_node *xent, *pxent = NULL;
+		struct ubifs_dent_node *xent;

  		if (ui->xattr_cnt >= ubifs_xattr_max_cnt(c)) {
  			ubifs_err(c, "Cannot delete inode, it has too much xattrs!");
  			goto out_release;
  		}

+		fname_name(&nm) = kmalloc(UBIFS_MAX_NLEN, GFP_NOFS);
+		if (!fname_name(&nm)) {
+			err = -ENOMEM;
+			goto out_release;
+		}
+
  		lowest_xent_key(c, &key, inode->i_ino);
  		while (1) {
  			xent = ubifs_tnc_next_ent(c, &key, &nm);
@@ -894,11 +900,12 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, 
const struct inode *inode)
  				if (err == -ENOENT)
  					break;

+				kfree(fname_name(&nm));
  				goto out_release;
  			}

-			fname_name(&nm) = xent->name;
  			fname_len(&nm) = le16_to_cpu(xent->nlen);
+			strncpy(fname_name(&nm), xent->name, fname_len(&nm));

  			xino = ubifs_iget(c->vfs_sb, le64_to_cpu(xent->inum));
  			if (IS_ERR(xino)) {
@@ -907,6 +914,7 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, 
const struct inode *inode)
  					  xent->name, err);
  				ubifs_ro_mode(c, err);
  				kfree(xent);
+				kfree(fname_name(&nm));
  				goto out_release;
  			}
  			ubifs_assert(c, ubifs_inode(xino)->xattr);
@@ -916,11 +924,10 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, 
const struct inode *inode)
  			ino = (void *)ino + UBIFS_INO_NODE_SZ;
  			iput(xino);

-			kfree(pxent);
-			pxent = xent;
  			key_read(c, &xent->key, &key);
+			kfree(xent);
  		}
-		kfree(pxent);
+		kfree(fname_name(&nm));
  	}

  	pack_inode(c, ino, inode, 1);

The kill_xattrs process is more intuitive without the pxent. However, 
the release process for the memory (stores xent->name) is similar to 
'pxent'. If you think it's better than v1, I will send v2.


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH 1/2] ubifs: xattr: Fix some potential memory leaks while iterating entries

[Richard Weinberger]

On Mon, Sep 14, 2020 at 5:25 AM Zhihao Cheng <chengzhihao1@huawei.com> wrote:
> 在 2020/9/14 3:08, Richard Weinberger 写道:
> > On Mon, Jun 1, 2020 at 11:11 AM Zhihao Cheng <chengzhihao1@huawei.com> wrote:
> The kill_xattrs process is more intuitive without the pxent. However,
> the release process for the memory (stores xent->name) is similar to
> 'pxent'. If you think it's better than v1, I will send v2.

You are right. We don't gain much. So I'll take v1.
Thanks a lot for fixing!

-- 
Thanks,
//richard

Re: [PATCH 1/2] ubifs: xattr: Fix some potential memory leaks while iterating entries

[Richard Weinberger]

On Mon, Sep 14, 2020 at 5:25 AM Zhihao Cheng <chengzhihao1@huawei.com> wrote:
> 在 2020/9/14 3:08, Richard Weinberger 写道:
> > On Mon, Jun 1, 2020 at 11:11 AM Zhihao Cheng <chengzhihao1@huawei.com> wrote:
> The kill_xattrs process is more intuitive without the pxent. However,
> the release process for the memory (stores xent->name) is similar to
> 'pxent'. If you think it's better than v1, I will send v2.

You are right. We don't gain much. So I'll take v1.
Thanks a lot for fixing!

-- 
Thanks,
//richard

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/