From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS, USER_AGENT_NEOMUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6BD9FC61CE8 for ; Sat, 19 Jan 2019 15:12:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 369C02086D for ; Sat, 19 Jan 2019 15:12:16 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=brauner.io header.i=@brauner.io header.b="S9oTJgLn" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728249AbfASPMP (ORCPT ); Sat, 19 Jan 2019 10:12:15 -0500 Received: from mail-wm1-f68.google.com ([209.85.128.68]:33715 "EHLO mail-wm1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728161AbfASPMP (ORCPT ); Sat, 19 Jan 2019 10:12:15 -0500 Received: by mail-wm1-f68.google.com with SMTP id r24so3009291wmh.0 for ; Sat, 19 Jan 2019 07:12:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brauner.io; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=VZ1Pz56Ucmeb4XI9yB3BgI/hz7cJElYTJOwbSWP9BMk=; b=S9oTJgLnrpJV3kqzlKH4120nwG+PbuhS65OAeBqH8tU815OMKaOHlLLxZ+tjHrN911 AX4pmBYPXFCC4RMW3ThOqBgP1GEfgmuuLc1DqGAARB/4kG5S97csXYY0/iZd2SD5xmRN V9ehzv4/hSUyJzMOBSqP1h7mcbH/D/bSMupHdgUiIMUyxBzy+WcB+5mm/v/7WPxU3i7M SYkMR5rK3kNvolliXjjgVu+zF+GzJXpD5sn6MkOzAeYV8Z2yT7Gh5alXZ1ABK/sYV03V Ov5SBm8+r4ZAtgm/6gRdWCtcIbzDFDZvr2Fk1Gw/IU0Q0ZJviRc9QoDzJRLF6K4UFB1z jRCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=VZ1Pz56Ucmeb4XI9yB3BgI/hz7cJElYTJOwbSWP9BMk=; b=t2To4qsgOCfRDRts/uEz0u7s7HZrezbUSaJu2aI6HhAg+kojQeq+jP/nh1oZ4irSrY HuZ9VsGLGkX6Vvy5AyiXZV3gqMF2cAxjNyfIQvtr2BrXEdT1ir1y4RIc7r7wIrTD4E+J 30cKyn3FwqM1PKnvuBBX0CKriGLrBnf4TKPJC2VGZ/yHzKu3bWN5TP+n/gpW44ichs/D ULihvmCLef+VeMx2V5B6vxDFYvpN+CUAK5LoQLuhX36xb1+Np1Cjd0cW7ullw8PkOlin +e+lclPBGs6k0SzW9OO5sB/VdNY0QfzQ8g/05teOey16G52RLFFpC3035V2+CgKuI1eX Lvfg== X-Gm-Message-State: AJcUukexxV7xcVUKnrVuwPIitxAA5xZpDiElc6JOgmE2ZyFZLXfV/VlL E0qpSDXf6rsWITXizFH9usPuUoo5sm+WQw== X-Google-Smtp-Source: ALg8bN6p1FsPmn5HGDJFTSC/prw0LTjajwD9c7b16bdlwuWz2wukd7AupuWfugU3kxffEXi/c0pBeA== X-Received: by 2002:a1c:df46:: with SMTP id w67mr19534750wmg.51.1547910733434; Sat, 19 Jan 2019 07:12:13 -0800 (PST) Received: from brauner.io ([196.167.47.106]) by smtp.gmail.com with ESMTPSA id w80sm62795680wme.38.2019.01.19.07.12.11 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sat, 19 Jan 2019 07:12:13 -0800 (PST) Date: Sat, 19 Jan 2019 16:12:09 +0100 From: Christian Brauner To: Al Viro Cc: gregkh@linuxfoundation.org, devel@driverdev.osuosl.org, linux-fsdevel@vger.kernel.org, tkjos@google.com Subject: Re: [PATCH 3/5] binderfs: rework binderfs_fill_super() Message-ID: <20190119151207.glezlmnu3n3a4cdm@brauner.io> References: <20190118145344.11532-1-christian@brauner.io> <20190118145344.11532-4-christian@brauner.io> <20190118230354.GA2217@ZenIV.linux.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20190118230354.GA2217@ZenIV.linux.org.uk> User-Agent: NeoMutt/20180716 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org On Fri, Jan 18, 2019 at 11:03:54PM +0000, Al Viro wrote: > On Fri, Jan 18, 2019 at 03:53:42PM +0100, Christian Brauner wrote: > > static int binderfs_fill_super(struct super_block *sb, void *data, int silent) > > { > > + int ret; > > struct binderfs_info *info; > > - int ret = -ENOMEM; > > struct inode *inode = NULL; > > struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns; > > > > @@ -495,13 +495,14 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent) > > sb->s_op = &binderfs_super_ops; > > sb->s_time_gran = 1; > > > > - info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL); > > - if (!info) > > - goto err_without_dentry; > > + sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL); > > + if (!sb->s_fs_info) > > + return -ENOMEM; > > + info = sb->s_fs_info; > > ... and that's when you should grab ipcns reference and stick it into > info->ipc_ns, to match the logics in binderfs_kill_super(). > > Otherwise the failure above > > > ret = binderfs_parse_mount_opts(data, &info->mount_opts); > > if (ret) > > - goto err_without_dentry; > > + return ret; > > ... or here leaves you with an ipcns leak. > > Destructor does > if ->s_fs_info is non-NULL > release ->s_fs_info->ipc_ns > free ->s_fs_info > so constructor should not leave object in a state when ipcns is already > grabbed, but not stored in ->s_fs_info->ipc_ns (including the case of > allocation failure leaving it with NULL ->s_fs_info). Yeah, total brainfart on my side. I shouldn't code in airports apparently... Fixed.