* [PATCH] afs: Fix afs_cb_interest refcnt leak in afs_select_fileserver()
@ 2020-05-25 14:11 Xiyu Yang
2020-05-26 16:18 ` David Howells
0 siblings, 1 reply; 2+ messages in thread
From: Xiyu Yang @ 2020-05-25 14:11 UTC (permalink / raw)
To: David Howells, linux-afs, linux-kernel
Cc: yuanxzhang, kjlu, Xiyu Yang, Xin Tan
afs_select_fileserver() invokes afs_get_cb_interest(), which returns a
reference of the specified afs_cb_interest object to "fc->cbi" with
increased refcnt.
The reference counting issue happens in one exception handling path of
afs_select_fileserver(). When error occurred in
afs_wait_for_fs_probes(), the function forgets to decrease the refcnt
increased by afs_get_cb_interest(), causing a refcnt leak.
Fix this issue by calling afs_put_cb_interest() when error occurred in
afs_wait_for_fs_probes().
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
---
fs/afs/rotate.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c
index 2a3305e42b14..f73af16cdb92 100644
--- a/fs/afs/rotate.c
+++ b/fs/afs/rotate.c
@@ -357,8 +357,10 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc)
_debug("pick [%lx]", fc->untried);
error = afs_wait_for_fs_probes(fc->server_list, fc->untried);
- if (error < 0)
+ if (error < 0) {
+ afs_put_cb_interest(afs_v2net(vnode), fc->cbi);
goto failed_set_error;
+ }
/* Pick the untried server with the lowest RTT. If we have outstanding
* callbacks, we stick with the server we're already using if we can.
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] afs: Fix afs_cb_interest refcnt leak in afs_select_fileserver()
2020-05-25 14:11 [PATCH] afs: Fix afs_cb_interest refcnt leak in afs_select_fileserver() Xiyu Yang
@ 2020-05-26 16:18 ` David Howells
0 siblings, 0 replies; 2+ messages in thread
From: David Howells @ 2020-05-26 16:18 UTC (permalink / raw)
To: Xiyu Yang; +Cc: dhowells, linux-afs, linux-kernel, yuanxzhang, kjlu, Xin Tan
Xiyu Yang <xiyuyang19@fudan.edu.cn> wrote:
> error = afs_wait_for_fs_probes(fc->server_list, fc->untried);
> - if (error < 0)
> + if (error < 0) {
> + afs_put_cb_interest(afs_v2net(vnode), fc->cbi);
> goto failed_set_error;
> + }
Ummm... Did you try this? afs_end_vnode_operation() should then cause a
double free because you don't clear fc->cbi.
You can try it by installing the kafs-client package if your distribution has
it available and starting the afs.mount service or doing:
mount -t afs none /afs -o dyn
and then:
ls /afs/grand.central.org/
David
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-05-26 16:19 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-25 14:11 [PATCH] afs: Fix afs_cb_interest refcnt leak in afs_select_fileserver() Xiyu Yang
2020-05-26 16:18 ` David Howells
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).