Hugetlbf segv on invalid mount option and mem leak

["Chen, Kenneth W" <kenneth.w.chen@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 627 bytes --]

Here is a patch that fixes a rather nasty bug in hugetlbfs.  If root
tries to mount a hugetlbfs with invalid mount option,
hugetlbfs_fill_super incorrectly returns error code instead of NULL on
couple error conditions, causing generic vfs layer to segfault and took
some semaphore with it, the end result is kernel hang on any subsequent
file system mount/unmount.  There are some other cases that has memory
leak upon error conditions.

The first problem is 2.4 specific, while memleak problem exist in both
2.4 and 2.6.
Bjorn, again, would you please merge in your 2.4 tree?  I'll push the
rest for 2.6.

- Ken

[-- Attachment #2: hugetlbfs-memleak.patch --]
[-- Type: application/octet-stream, Size: 1574 bytes --]

diff -Nurp 2.4.23-pre5/fs/hugetlbfs/inode.c 2.4.23-pre5.ken/fs/hugetlbfs/inode.c
--- 2.4.23-pre5/fs/hugetlbfs/inode.c	Fri Sep 26 14:47:03 2003
+++ 2.4.23-pre5.ken/fs/hugetlbfs/inode.c	Fri Sep 26 14:28:21 2003
@@ -622,23 +622,21 @@ hugetlbfs_fill_super(struct super_block 
 {
 	struct inode * inode;
 	struct dentry * root;
-	int ret;
 	struct hugetlbfs_config config;
 	struct hugetlbfs_sb_info *sbinfo;
 
-	sbinfo = kmalloc(sizeof(struct hugetlbfs_sb_info), GFP_KERNEL);
-	if (!sbinfo)
-		return -ENOMEM;
-	sb->u.generic_sbp = sbinfo;
- 
 	config.nr_blocks = -1; /* No limit on size by default. */
 	config.nr_inodes = -1; /* No limit on number of inodes by default. */
 	config.uid = current->fsuid;
 	config.gid = current->fsgid;
 	config.mode = 0755;
-	ret = hugetlbfs_parse_options(data, &config);
-	if (ret)
-		return ret;
+	if (hugetlbfs_parse_options(data, &config))
+		return NULL;
+
+	sbinfo = kmalloc(sizeof(struct hugetlbfs_sb_info), GFP_KERNEL);
+	if (!sbinfo)
+		return NULL;
+	sb->u.generic_sbp = sbinfo;
 
 	spin_lock_init(&sbinfo->stat_lock);
 	sbinfo->max_blocks = config.nr_blocks;
@@ -652,15 +650,18 @@ hugetlbfs_fill_super(struct super_block 
 	inode = hugetlbfs_get_inode(sb, config.uid, config.gid,
 				S_IFDIR | config.mode, 0);
 	if (!inode)
-		return NULL;
+		goto out_free;
 
 	root = d_alloc_root(inode);
 	if (!root) {
 		iput(inode);
-		return NULL;
+		goto out_free;
 	}
 	sb->s_root = root;
 	return sb;
+out_free:
+	kfree(sbinfo);
+	return NULL;
 }
 
 static DECLARE_FSTYPE(hugetlbfs_fs_type, "hugetlbfs", hugetlbfs_fill_super, FS_LITTER);