Re: [PATCH] ceph: fix potential double free

[Alex Elder <elder@inktank.com>]

On 07/13/2012 09:28 AM, Alan Cox wrote:
> From: Alan Cox <alan@linux.intel.com>
> 
> We re-run the loop but we don't re-set the attrs pointer back to NULL.

It looks to me like we're OK here without this.

At the top of the loop, the if condition either holds or it does not.
- If it does not, we don't touch "xattrs" again, before returning "err".
- If the condition holds, the next time "xattrs" is touched is when its
  value is assigned the result of a kcalloc() call.

That being said, I really do prefer to have pointers get invalidated
after their freed, so I'll happily add your change...

Reviewed-by: Alex Elder <elder@inktank.com>

> Signed-off-by: Alan Cox <alan@linux.intel.com>
> ---
> 
>  fs/ceph/xattr.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
> index 785cb30..2c2ae5b 100644
> --- a/fs/ceph/xattr.c
> +++ b/fs/ceph/xattr.c
> @@ -457,6 +457,7 @@ start:
>  			for (i = 0; i < numattr; i++)
>  				kfree(xattrs[i]);
>  			kfree(xattrs);
> +			xattrs = NULL;
>  			goto start;
>  		}
>  		err = -EIO;
> 
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
>