* [PATCH] jfs: fix metapage reference count leak in dbAllocCtl
@ 2025-07-29 1:22 Zheng Yu
2025-07-29 13:50 ` Dave Kleikamp
0 siblings, 1 reply; 4+ messages in thread
From: Zheng Yu @ 2025-07-29 1:22 UTC (permalink / raw)
To: shaggy@kernel.org
Cc: eadavis@qq.com, rand.sec96@gmail.com, aha310510@gmail.com,
niharchaithanya@gmail.com, kovalev@altlinux.org,
jfs-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org
In dbAllocCtl(), read_metapage() increases the reference count of the
metapage. However, when dp->tree.budmin < 0, the function returns -EIO
without calling release_metapage() to decrease the reference count,
leading to a memory leak.
Add release_metapage(mp) before the error return to properly manage
the metapage reference count and prevent the leak.
Fixes: 51a203470f502a64a3da8dcea51c4748e8267a6c ("jfs: fix shift-out-of-bounds in dbSplit")
Signed-off-by: Zheng Yu <zheng.yu@northwestern.edu>
---
fs/jfs/jfs_dmap.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 35e063c9f3a4..5a877261c3fe 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1809,8 +1809,10 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results)
return -EIO;
dp = (struct dmap *) mp->data;
- if (dp->tree.budmin < 0)
+ if (dp->tree.budmin < 0) {
+ release_metapage(mp);
return -EIO;
+ }
/* try to allocate the blocks.
*/
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] jfs: fix metapage reference count leak in dbAllocCtl
2025-07-29 1:22 [PATCH] jfs: fix metapage reference count leak in dbAllocCtl Zheng Yu
@ 2025-07-29 13:50 ` Dave Kleikamp
0 siblings, 0 replies; 4+ messages in thread
From: Dave Kleikamp @ 2025-07-29 13:50 UTC (permalink / raw)
To: Zheng Yu
Cc: eadavis@qq.com, rand.sec96@gmail.com, aha310510@gmail.com,
niharchaithanya@gmail.com, kovalev@altlinux.org,
jfs-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org
On 7/28/25 8:22PM, Zheng Yu wrote:
> In dbAllocCtl(), read_metapage() increases the reference count of the
> metapage. However, when dp->tree.budmin < 0, the function returns -EIO
> without calling release_metapage() to decrease the reference count,
> leading to a memory leak.
>
> Add release_metapage(mp) before the error return to properly manage
> the metapage reference count and prevent the leak.
Thanks for catching this.
>
> Fixes: 51a203470f502a64a3da8dcea51c4748e8267a6c ("jfs: fix shift-out-of-bounds in dbSplit")
The correct commit is a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d. I'm
guessing the above is from one of the stable branches
Also, I'm fixing up the whitespace. You have spaces instead of tabs.
Applying and testing this.
Thanks!
Shaggy
>
> Signed-off-by: Zheng Yu <zheng.yu@northwestern.edu>
> ---
> fs/jfs/jfs_dmap.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index 35e063c9f3a4..5a877261c3fe 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -1809,8 +1809,10 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results)
> return -EIO;
> dp = (struct dmap *) mp->data;
>
> - if (dp->tree.budmin < 0)
> + if (dp->tree.budmin < 0) {
> + release_metapage(mp);
> return -EIO;
> + }
>
> /* try to allocate the blocks.
> */
> --
> 2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] jfs: fix metapage reference count leak in dbAllocCtl
@ 2025-07-29 0:05 Zheng Yu
2025-07-29 14:23 ` Markus Elfring
0 siblings, 1 reply; 4+ messages in thread
From: Zheng Yu @ 2025-07-29 0:05 UTC (permalink / raw)
To: Dave Kleikamp
Cc: Edward Adam Davis, Rand Deeb, Jeongjun Park, Nihar Chaithanya,
Zheng Yu, Vasiliy Kovalev, jfs-discussion, linux-kernel
In dbAllocCtl(), read_metapage() increases the reference count of the
metapage. However, when dp->tree.budmin < 0, the function returns -EIO
without calling release_metapage() to decrease the reference count,
leading to a memory leak.
Add release_metapage(mp) before the error return to properly manage
the metapage reference count and prevent the leak.
Fixes: 51a203470f502a64a3da8dcea51c4748e8267a6c ("jfs: fix shift-out-of-bounds in dbSplit")
Signed-off-by: Zheng Yu <zheng.yu@northwestern.edu>
---
fs/jfs/jfs_dmap.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 35e063c9f3a4..5a877261c3fe 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1809,8 +1809,10 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results)
return -EIO;
dp = (struct dmap *) mp->data;
- if (dp->tree.budmin < 0)
+ if (dp->tree.budmin < 0) {
+ release_metapage(mp);
return -EIO;
+ }
/* try to allocate the blocks.
*/
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] jfs: fix metapage reference count leak in dbAllocCtl
2025-07-29 0:05 Zheng Yu
@ 2025-07-29 14:23 ` Markus Elfring
0 siblings, 0 replies; 4+ messages in thread
From: Markus Elfring @ 2025-07-29 14:23 UTC (permalink / raw)
To: Zheng Yu, jfs-discussion, Dave Kleikamp
Cc: LKML, Edward Adam Davis, Jeongjun Park, Nihar Chaithanya,
Rand Deeb, Vasiliy Kovalev, Zheng Yu
…
> +++ b/fs/jfs/jfs_dmap.c
> @@ -1809,8 +1809,10 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results)
> return -EIO;
> dp = (struct dmap *) mp->data;
>
> - if (dp->tree.budmin < 0)
> + if (dp->tree.budmin < 0) {
> + release_metapage(mp);
> return -EIO;
> + }
…
Would it be a bit nicer to use an additional label for this case?
rc = -EIO;
goto release_metapage;
Regards,
Markus
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-07-29 14:24 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-29 1:22 [PATCH] jfs: fix metapage reference count leak in dbAllocCtl Zheng Yu
2025-07-29 13:50 ` Dave Kleikamp
-- strict thread matches above, loose matches on Subject: below --
2025-07-29 0:05 Zheng Yu
2025-07-29 14:23 ` Markus Elfring
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox