stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Chenyuan Mi <cymi20@fudan.edu.cn>,
	Xiyu Yang <xiyuyang19@fudan.edu.cn>,
	Xin Tan <tanxin.ctf@gmail.com>,
	Mike Marshall <hubcap@omnibond.com>,
	Sasha Levin <sashal@kernel.org>,
	devel@lists.orangefs.org
Subject: [PATCH AUTOSEL 5.15 09/65] orangefs: Fix sb refcount leak when allocate sb info failed.
Date: Tue, 16 Nov 2021 14:03:29 -0500	[thread overview]
Message-ID: <20211116190443.2418144-9-sashal@kernel.org> (raw)
In-Reply-To: <20211116190443.2418144-1-sashal@kernel.org>

From: Chenyuan Mi <cymi20@fudan.edu.cn>

[ Upstream commit ac2c63757f4f413980d6c676dbe1ae2941b94afa ]

The reference counting issue happens in one exception handling
path of orangefs_mount(). When failing to allocate sb info, the
function forgets to decrease the refcount of sb increased by
sget(), causing a refcount leak.

Fix this issue by jumping to the label "free_sb_and_op" instead
of "free_op"

Signed-off-by: Chenyuan Mi <cymi20@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/orangefs/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
index 2f2e430461b21..c46a9005fc445 100644
--- a/fs/orangefs/super.c
+++ b/fs/orangefs/super.c
@@ -526,7 +526,7 @@ struct dentry *orangefs_mount(struct file_system_type *fst,
 	sb->s_fs_info = kzalloc(sizeof(struct orangefs_sb_info_s), GFP_KERNEL);
 	if (!ORANGEFS_SB(sb)) {
 		d = ERR_PTR(-ENOMEM);
-		goto free_op;
+		goto free_sb_and_op;
 	}
 
 	ret = orangefs_fill_sb(sb,
-- 
2.33.0


  parent reply	other threads:[~2021-11-16 19:06 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-16 19:03 [PATCH AUTOSEL 5.15 01/65] Input: cpcap-pwrbutton - handle errors from platform_get_irq() Sasha Levin
2021-11-16 19:03 ` [PATCH AUTOSEL 5.15 02/65] kcsan: test: Fix flaky test case Sasha Levin
2021-11-16 19:03 ` [PATCH AUTOSEL 5.15 03/65] backlight: Propagate errors from get_brightness() Sasha Levin
2021-11-16 19:03 ` [PATCH AUTOSEL 5.15 04/65] UNRPC: Return specific error code on kmalloc failure Sasha Levin
2021-11-16 19:03 ` [PATCH AUTOSEL 5.15 05/65] NFS: Fix up nfs_ctx_key_to_expire() Sasha Levin
2021-11-16 19:03 ` [PATCH AUTOSEL 5.15 06/65] PCI: aardvark: Fix link training Sasha Levin
2021-11-16 19:03 ` [PATCH AUTOSEL 5.15 07/65] fbdev: fbmem: Fix double free of 'fb_info->pixmap.addr' Sasha Levin
2021-11-16 19:03 ` [PATCH AUTOSEL 5.15 08/65] drm/virtio: fix the missed drm_gem_object_put() in virtio_gpu_user_framebuffer_create() Sasha Levin
2021-11-16 19:03 ` Sasha Levin [this message]
2021-11-16 19:16 [PATCH AUTOSEL 5.15 01/65] Input: cpcap-pwrbutton - handle errors from platform_get_irq() Sasha Levin
2021-11-16 19:16 ` [PATCH AUTOSEL 5.15 09/65] orangefs: Fix sb refcount leak when allocate sb info failed Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211116190443.2418144-9-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=cymi20@fudan.edu.cn \
    --cc=devel@lists.orangefs.org \
    --cc=hubcap@omnibond.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tanxin.ctf@gmail.com \
    --cc=xiyuyang19@fudan.edu.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).