From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751995AbdC1Dyz (ORCPT ); Mon, 27 Mar 2017 23:54:55 -0400 Received: from out0-149.mail.aliyun.com ([140.205.0.149]:52694 "EHLO out0-149.mail.aliyun.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751288AbdC1Dyy (ORCPT ); Mon, 27 Mar 2017 23:54:54 -0400 X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R181e4;FP=0|-1|-1|-1|0|-1|-1|-1;HT=e02c03294;MF=hillf.zj@alibaba-inc.com;NM=1;PH=DS;RN=4;SR=0;TI=SMTPD_---.7roENKd_1490673273; Reply-To: "Hillf Danton" From: "Hillf Danton" To: "'Vito Caputo'" , Cc: "'linux-kernel'" , References: <20170327170534.GA16903@shells.gnugeneration.com> In-Reply-To: <20170327170534.GA16903@shells.gnugeneration.com> Subject: Re: [PATCH] shmem: fix __shmem_file_setup error path leaks Date: Tue, 28 Mar 2017 11:54:33 +0800 Message-ID: <018001d2a777$031dff10$0959fd30$@alibaba-inc.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQH8Wk1e6ts5kQRHpanc1AdKqjrOIaFWOB8w Content-Language: zh-cn Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On March 28, 2017 1:06 AM Vito Caputo wrote: > > The existing path and memory cleanups appear to be in reverse order, and > there's no iput() potentially leaking the inode in the last two error gotos. > > Also make put_memory shmem_unacct_size() conditional on !inode since if we > entered cleanup at put_inode, shmem_evict_inode() occurs via > iput()->iput_final(), which performs the shmem_unacct_size() for us. > > Signed-off-by: Vito Caputo > --- > > This caught my eye while looking through the memfd_create() implementation. > Included patch was compile tested only... > > mm/shmem.c | 15 +++++++++------ > 1 file changed, 9 insertions(+), 6 deletions(-) > > diff --git a/mm/shmem.c b/mm/shmem.c > index e67d6ba..a1a84eaf 100644 > --- a/mm/shmem.c > +++ b/mm/shmem.c > @@ -4134,7 +4134,7 @@ static struct file *__shmem_file_setup(const char *name, loff_t size, > unsigned long flags, unsigned int i_flags) > { > struct file *res; > - struct inode *inode; > + struct inode *inode = NULL; > struct path path; > struct super_block *sb; > struct qstr this; > @@ -4162,7 +4162,7 @@ static struct file *__shmem_file_setup(const char *name, loff_t size, > res = ERR_PTR(-ENOSPC); > inode = shmem_get_inode(sb, NULL, S_IFREG | S_IRWXUGO, 0, flags); > if (!inode) > - goto put_memory; > + goto put_path; > > inode->i_flags |= i_flags; > d_instantiate(path.dentry, inode); After this routine, the inode is in use of the dcache, as its comment says. > @@ -4170,19 +4170,22 @@ static struct file *__shmem_file_setup(const char *name, loff_t size, > clear_nlink(inode); /* It is unlinked */ > res = ERR_PTR(ramfs_nommu_expand_for_mapping(inode, size)); > if (IS_ERR(res)) > - goto put_path; > + goto put_inode; > > res = alloc_file(&path, FMODE_WRITE | FMODE_READ, > &shmem_file_operations); > if (IS_ERR(res)) > - goto put_path; > + goto put_inode; > > return res; > > -put_memory: > - shmem_unacct_size(flags, size); > +put_inode: > + iput(inode); > put_path: > path_put(&path); > +put_memory: > + if (!inode) > + shmem_unacct_size(flags, size); > return res; > } > > -- > 2.1.4