All of lore.kernel.org
 help / color / mirror / Atom feed
From: Daniel J Blueman <daniel.blueman@gmail.com>
To: miaox@cn.fujitsu.com, Josef Bacik <josef@redhat.com>,
	Chris Mason <chris.mason@oracle.com>,
	Linux Btrfs <linux-btrfs@vger.kernel.org>
Cc: Ito <t-itoh@jp.fujitsu.com>
Subject: [PATCH] btrfs: fix dip leak
Date: Thu, 10 Mar 2011 00:46:42 +0800	[thread overview]
Message-ID: <AANLkTikDN-v4C4rt-uTFQ35uoaoJ_9LRHSmAQUN4+uVD@mail.gmail.com> (raw)

2010/11/22 Miao Xie <miaox@cn.fujitsu.com>:
> bio_endio() will free dip and dip->csums, so dip and dip->csums twice=
 will
> be freed twice. Fix it.
>
> Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
> ---
> =A0fs/btrfs/inode.c | =A0 =A09 +++------
> =A01 files changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> index 558cac2..5a5edc7 100644
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
> @@ -5731,7 +5731,7 @@ static void btrfs_submit_direct(int rw, struct =
bio *bio, struct inode *inode,
>
> =A0 =A0 =A0 =A0ret =3D btrfs_bio_wq_end_io(root->fs_info, bio, 0);
> =A0 =A0 =A0 =A0if (ret)
> - =A0 =A0 =A0 =A0 =A0 =A0 =A0 goto out_err;
> + =A0 =A0 =A0 =A0 =A0 =A0 =A0 goto free_ordered;
>
> =A0 =A0 =A0 =A0if (write && !skip_sum) {
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0ret =3D btrfs_wq_submit_bio(BTRFS_I(in=
ode)->root->fs_info,
> @@ -5740,7 +5740,7 @@ static void btrfs_submit_direct(int rw, struct =
bio *bio, struct inode *inode,
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 _=
_btrfs_submit_bio_start_direct_io,
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 _=
_btrfs_submit_bio_done);
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0if (ret)
> - =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 goto out_err;
> + =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 goto free_ordered;
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0return;
> =A0 =A0 =A0 =A0} else if (!skip_sum)
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0btrfs_lookup_bio_sums_dio(root, inode,=
 bio,
> @@ -5748,11 +5748,8 @@ static void btrfs_submit_direct(int rw, struct=
 bio *bio, struct inode *inode,
>
> =A0 =A0 =A0 =A0ret =3D btrfs_map_bio(root, rw, bio, 0, 1);
> =A0 =A0 =A0 =A0if (ret)
> - =A0 =A0 =A0 =A0 =A0 =A0 =A0 goto out_err;
> + =A0 =A0 =A0 =A0 =A0 =A0 =A0 goto free_ordered;
> =A0 =A0 =A0 =A0return;
> -out_err:
> - =A0 =A0 =A0 kfree(dip->csums);
> - =A0 =A0 =A0 kfree(dip);
> =A0free_ordered:
> =A0 =A0 =A0 =A0/*
> =A0 =A0 =A0 =A0 * If this is a write, we need to clean up the reserve=
d space and kill

The previous patch is broken and leaks dip when dip->csums allocation
fails; bio->bi_end_io isn't set at the point where the free_ordered
branch is consequently taken, thus bio_endio doesn't call the function
which would free it in the normal case. Fix.

Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 0efdb65..53f4c8e 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6056,6 +6056,7 @@ static void btrfs_submit_direct(int rw, struct
bio *bio, struct inode *inode,
 	if (!skip_sum) {
 		dip->csums =3D kmalloc(sizeof(u32) * bio->bi_vcnt, GFP_NOFS);
 		if (!dip->csums) {
+			kfree(dip);
 			ret =3D -ENOMEM;
 			goto free_ordered;
 		}
--=20
Daniel J Blueman
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" =
in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

             reply	other threads:[~2011-03-09 16:46 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-03-09 16:46 Daniel J Blueman [this message]
2011-03-10  2:54 ` [PATCH] btrfs: fix dip leak Miao Xie

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=AANLkTikDN-v4C4rt-uTFQ35uoaoJ_9LRHSmAQUN4+uVD@mail.gmail.com \
    --to=daniel.blueman@gmail.com \
    --cc=chris.mason@oracle.com \
    --cc=josef@redhat.com \
    --cc=linux-btrfs@vger.kernel.org \
    --cc=miaox@cn.fujitsu.com \
    --cc=t-itoh@jp.fujitsu.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.