[PATCH] fs/iomap: fix memory leak on error condition

[PATCH] fs/iomap: fix memory leak on error condition

[Garry McNulty]

If the call to is_sync_kiocb() fails an error is returned without
freeing dio. Set the return code and jump to out_free_dio.

Detected by CoverityScan, CID 1429424 ("Resource leak")

Signed-off-by: Garry McNulty <garrmcnu@gmail.com>
---
 fs/iomap.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/iomap.c b/fs/iomap.c
index afd163586aa0..65c5db38c15a 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -1063,8 +1063,10 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
 		iomap_dio_set_error(dio, ret);
 
 	if (!atomic_dec_and_test(&dio->ref)) {
-		if (!is_sync_kiocb(iocb))
-			return -EIOCBQUEUED;
+		if (!is_sync_kiocb(iocb)) {
+			ret = -EIOCBQUEUED;
+			goto out_free_dio;
+		}
 
 		for (;;) {
 			set_current_state(TASK_UNINTERRUPTIBLE);
-- 
2.14.3

Re: [PATCH] fs/iomap: fix memory leak on error condition

[Dave Chinner]

On Wed, Feb 21, 2018 at 08:41:28PM +0000, Garry McNulty wrote:
> If the call to is_sync_kiocb() fails an error is returned without
> freeing dio. Set the return code and jump to out_free_dio.
> 
> Detected by CoverityScan, CID 1429424 ("Resource leak")

Coverity is wrong.

> Signed-off-by: Garry McNulty <garrmcnu@gmail.com>
> ---
>  fs/iomap.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/iomap.c b/fs/iomap.c
> index afd163586aa0..65c5db38c15a 100644
> --- a/fs/iomap.c
> +++ b/fs/iomap.c
> @@ -1063,8 +1063,10 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
>  		iomap_dio_set_error(dio, ret);
>  
>  	if (!atomic_dec_and_test(&dio->ref)) {
> -		if (!is_sync_kiocb(iocb))
> -			return -EIOCBQUEUED;
> +		if (!is_sync_kiocb(iocb)) {
> +			ret = -EIOCBQUEUED;
> +			goto out_free_dio;
> +		}

This is where we return after AIO submission. The struct dio has
already been attached to the bio we have submitted, and will be
freed on IO completion.  We are simply not waiting for IO completion
here, instead leaving it to the completion code to free the struct
dio and pass the completion status to the AIO code appropriately.

Cheers,

Dave.
-- 
Dave Chinner
david@fromorbit.com

Re: [PATCH] fs/iomap: fix memory leak on error condition

[Garry McNulty]

On 21 February 2018 at 21:56, Dave Chinner <david@fromorbit.com> wrote:
>
> On Wed, Feb 21, 2018 at 08:41:28PM +0000, Garry McNulty wrote:
> > If the call to is_sync_kiocb() fails an error is returned without
> > freeing dio. Set the return code and jump to out_free_dio.
> >
> > Detected by CoverityScan, CID 1429424 ("Resource leak")
>
> Coverity is wrong.
>
> > Signed-off-by: Garry McNulty <garrmcnu@gmail.com>
> > ---
> >  fs/iomap.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/iomap.c b/fs/iomap.c
> > index afd163586aa0..65c5db38c15a 100644
> > --- a/fs/iomap.c
> > +++ b/fs/iomap.c
> > @@ -1063,8 +1063,10 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
> >               iomap_dio_set_error(dio, ret);
> >
> >       if (!atomic_dec_and_test(&dio->ref)) {
> > -             if (!is_sync_kiocb(iocb))
> > -                     return -EIOCBQUEUED;
> > +             if (!is_sync_kiocb(iocb)) {
> > +                     ret = -EIOCBQUEUED;
> > +                     goto out_free_dio;
> > +             }
>
> This is where we return after AIO submission. The struct dio has
> already been attached to the bio we have submitted, and will be
> freed on IO completion.  We are simply not waiting for IO completion
> here, instead leaving it to the completion code to free the struct
> dio and pass the completion status to the AIO code appropriately.
>
ah OK, thanks for reviewing and for the explanation.

Cheers

Garry