[PATCH 1/3] jbd2: fix potential double free

[PATCH 1/3] jbd2: fix potential double free

[Chengguang Xu]

When fail from creating cache jbd2_inode_cache, we will
destroy previously created cache jbd2_handle_cache twice.
This patch fixes it by removing first destroy in error path.

Signed-off-by: Chengguang Xu <cgxu519@gmail.com>
---
 fs/jbd2/journal.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 382c030cc78b..49797854ccb8 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2642,7 +2642,6 @@ static int __init jbd2_journal_init_handle_cache(void)
 	jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
 	if (jbd2_inode_cache == NULL) {
 		printk(KERN_EMERG "JBD2: failed to create inode cache\n");
-		kmem_cache_destroy(jbd2_handle_cache);
 		return -ENOMEM;
 	}
 	return 0;
-- 
2.20.1

[PATCH 2/3] jbd2: code cleanup for jbd2_journal_init_revoke_caches()

[Chengguang Xu]

jbd2_journal_destroy_caches() can handle destruction work
for all caches, so we don't have to destroy previously
created cache in error path, it also makes the code simpler.

Signed-off-by: Chengguang Xu <cgxu519@gmail.com>
---
 fs/jbd2/revoke.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index a1143e57a718..3b46b45d085d 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -194,17 +194,14 @@ int __init jbd2_journal_init_revoke_caches(void)
 	jbd2_revoke_record_cache = KMEM_CACHE(jbd2_revoke_record_s,
 					SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY);
 	if (!jbd2_revoke_record_cache)
-		goto record_cache_failure;
+		return -ENOMEM;
 
 	jbd2_revoke_table_cache = KMEM_CACHE(jbd2_revoke_table_s,
 					     SLAB_TEMPORARY);
 	if (!jbd2_revoke_table_cache)
-		goto table_cache_failure;
-	return 0;
-table_cache_failure:
-	jbd2_journal_destroy_revoke_caches();
-record_cache_failure:
 		return -ENOMEM;
+
+	return 0;
 }
 
 static struct jbd2_revoke_table_s *jbd2_journal_init_revoke_table(int hash_size)
-- 
2.20.1

[PATCH 3/3] jbd2: add __init annotation for jbd2_journal_init_journal_head_cache()

[Chengguang Xu]

jbd2_journal_init_journal_head_cache() only be called once,
so add __init annotation for it and do some code cleanup.

Signed-off-by: Chengguang Xu <cgxu519@gmail.com>
---
 fs/jbd2/journal.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 49797854ccb8..43399ad423d0 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2371,22 +2371,19 @@ static struct kmem_cache *jbd2_journal_head_cache;
 static atomic_t nr_journal_heads = ATOMIC_INIT(0);
 #endif
 
-static int jbd2_journal_init_journal_head_cache(void)
+static int __init jbd2_journal_init_journal_head_cache(void)
 {
-	int retval;
-
 	J_ASSERT(jbd2_journal_head_cache == NULL);
 	jbd2_journal_head_cache = kmem_cache_create("jbd2_journal_head",
 				sizeof(struct journal_head),
 				0,		/* offset */
 				SLAB_TEMPORARY | SLAB_TYPESAFE_BY_RCU,
 				NULL);		/* ctor */
-	retval = 0;
 	if (!jbd2_journal_head_cache) {
-		retval = -ENOMEM;
 		printk(KERN_EMERG "JBD2: no memory for journal_head cache\n");
+		return -ENOMEM;
 	}
-	return retval;
+	return 0;
 }
 
 static void jbd2_journal_destroy_journal_head_cache(void)
-- 
2.20.1

Re: [PATCH 1/3] jbd2: fix potential double free

[sunny.s.zhang]

Hi Chengguang,

在 2019年05月05日 19:01, Chengguang Xu 写道:
> When fail from creating cache jbd2_inode_cache, we will
> destroy previously created cache jbd2_handle_cache twice.
> This patch fixes it by removing first destroy in error path.
>
> Signed-off-by: Chengguang Xu <cgxu519@gmail.com>
> ---
>   fs/jbd2/journal.c | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
> index 382c030cc78b..49797854ccb8 100644
> --- a/fs/jbd2/journal.c
> +++ b/fs/jbd2/journal.c
> @@ -2642,7 +2642,6 @@ static int __init jbd2_journal_init_handle_cache(void)
>   	jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
>   	if (jbd2_inode_cache == NULL) {
>   		printk(KERN_EMERG "JBD2: failed to create inode cache\n");
> -		kmem_cache_destroy(jbd2_handle_cache);
Maybe we should keep it, and set the jbd2_handle_cache to NULL.
If there are some changes in the future,  we may forget to change the 
function
of jbd2_journal_destroy_handle_cache.

Thanks,
Sunny

>   		return -ENOMEM;
>   	}
>   	return 0;

Re: [PATCH 1/3] jbd2: fix potential double free

[Jan Kara]

On Wed 08-05-19 14:38:22, sunny.s.zhang wrote:
> Hi Chengguang,
> 
> 在 2019年05月05日 19:01, Chengguang Xu 写道:
> > When fail from creating cache jbd2_inode_cache, we will
> > destroy previously created cache jbd2_handle_cache twice.
> > This patch fixes it by removing first destroy in error path.
> > 
> > Signed-off-by: Chengguang Xu <cgxu519@gmail.com>
> > ---
> >   fs/jbd2/journal.c | 1 -
> >   1 file changed, 1 deletion(-)
> > 
> > diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
> > index 382c030cc78b..49797854ccb8 100644
> > --- a/fs/jbd2/journal.c
> > +++ b/fs/jbd2/journal.c
> > @@ -2642,7 +2642,6 @@ static int __init jbd2_journal_init_handle_cache(void)
> >   	jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
> >   	if (jbd2_inode_cache == NULL) {
> >   		printk(KERN_EMERG "JBD2: failed to create inode cache\n");
> > -		kmem_cache_destroy(jbd2_handle_cache);
> Maybe we should keep it, and set the jbd2_handle_cache to NULL.
> If there are some changes in the future,  we may forget to change the
> function
> of jbd2_journal_destroy_handle_cache.

So what I'd do is that I'd split initialization of jbd2_inode_cache into a
separate function (and the same for destruction). That more aligns with how
things are currently done in jbd2 and also fixes the problem with double
destruction.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR