[Cluster-devel] [PATCH] gfs2: get rid of potential double free

[Cluster-devel] [PATCH] gfs2: get rid of potential double free

[Pan Bian]

__gfs2_set_acl will not increase the reference count of acl if it fails.
In this case, posix_acl_release are called twice, one after
__gfs2_set_acl and one in the error handling block. This patch does not
release acl when __gfs2_set_acl fails.

Fixes: e01580bf9e4("gfs2: use generic posix ACL infrastructure")
Signed-off-by: Pan Bian <bianpan2016@163.com>
---
 fs/gfs2/inode.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 648f0ca..3a9041c 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -744,12 +744,13 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
 			       the gfs2 structures. */
 	if (default_acl) {
 		error = __gfs2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
-		posix_acl_release(default_acl);
+		if (!error)
+			posix_acl_release(default_acl);
 	}
-	if (acl) {
+	if (acl && !error) {
+		error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
 		if (!error)
-			error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
-		posix_acl_release(acl);
+			posix_acl_release(acl);
 	}
 
 	if (error)
-- 
2.7.4

[PATCH] gfs2: get rid of potential double free

[Pan Bian]

__gfs2_set_acl will not increase the reference count of acl if it fails.
In this case, posix_acl_release are called twice, one after
__gfs2_set_acl and one in the error handling block. This patch does not
release acl when __gfs2_set_acl fails.

Fixes: e01580bf9e4("gfs2: use generic posix ACL infrastructure")
Signed-off-by: Pan Bian <bianpan2016@163.com>
---
 fs/gfs2/inode.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 648f0ca..3a9041c 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -744,12 +744,13 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
 			       the gfs2 structures. */
 	if (default_acl) {
 		error = __gfs2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
-		posix_acl_release(default_acl);
+		if (!error)
+			posix_acl_release(default_acl);
 	}
-	if (acl) {
+	if (acl && !error) {
+		error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
 		if (!error)
-			error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
-		posix_acl_release(acl);
+			posix_acl_release(acl);
 	}
 
 	if (error)
-- 
2.7.4

[Cluster-devel] [PATCH] gfs2: get rid of potential double free

[Andreas Gruenbacher]

Pan,

On Mon, 26 Nov 2018 at 09:44, Pan Bian <bianpan2016@163.com> wrote:

> __gfs2_set_acl will not increase the reference count of acl if it fails.
> In this case, posix_acl_release are called twice, one after
> __gfs2_set_acl and one in the error handling block. This patch does not
> release acl when __gfs2_set_acl fails.
>

thanks for the bug report and patch; I think this should be fixed more
clearly as in the patch I've posted earlier today.

Andreas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/cluster-devel/attachments/20181127/ade5008f/attachment.htm>

[Cluster-devel] [PATCH] gfs2: get rid of potential double free

[PanBian]

On Tue, Nov 27, 2018 at 12:19:48AM +0100, Andreas Gruenbacher wrote:
> Pan,
> 
> On Mon, 26 Nov 2018 at 09:44, Pan Bian <bianpan2016@163.com> wrote:
> 
> > __gfs2_set_acl will not increase the reference count of acl if it fails.
> > In this case, posix_acl_release are called twice, one after
> > __gfs2_set_acl and one in the error handling block. This patch does not
> > release acl when __gfs2_set_acl fails.
> >
> 
> thanks for the bug report and patch; I think this should be fixed more
> clearly as in the patch I've posted earlier today.

I have seen the patch. It is really much clearer. Thank you!

Pan


> 
> Andreas

Re: [PATCH] gfs2: get rid of potential double free

[PanBian]

On Tue, Nov 27, 2018 at 12:19:48AM +0100, Andreas Gruenbacher wrote:
> Pan,
> 
> On Mon, 26 Nov 2018 at 09:44, Pan Bian <bianpan2016@163.com> wrote:
> 
> > __gfs2_set_acl will not increase the reference count of acl if it fails.
> > In this case, posix_acl_release are called twice, one after
> > __gfs2_set_acl and one in the error handling block. This patch does not
> > release acl when __gfs2_set_acl fails.
> >
> 
> thanks for the bug report and patch; I think this should be fixed more
> clearly as in the patch I've posted earlier today.

I have seen the patch. It is really much clearer. Thank you!

Pan


> 
> Andreas