From patchwork Wed May 25 16:19:54 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Boaz Harrosh X-Patchwork-Id: 816532 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p4PGJrBc022880 for ; Wed, 25 May 2011 16:19:53 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758090Ab1EYQTs (ORCPT ); Wed, 25 May 2011 12:19:48 -0400 Received: from daytona.panasas.com ([67.152.220.89]:36906 "EHLO daytona.panasas.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758087Ab1EYQTq (ORCPT ); Wed, 25 May 2011 12:19:46 -0400 Received: from fs2.bhalevy.com ([172.17.33.70]) by daytona.panasas.com with Microsoft SMTPSVC(6.0.3790.4675); Wed, 25 May 2011 12:19:45 -0400 Message-ID: <4DDD2C2A.1070102@panasas.com> Date: Wed, 25 May 2011 19:19:54 +0300 From: Boaz Harrosh User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110430 Remi/fc12 Thunderbird/3.1.10 MIME-Version: 1.0 To: Benny Halevy , Trond Myklebust , linux-nfs@vger.kernel.org, Andy Adamson , Fred Isaman Subject: [PATCH V2] SQUASHME: pnfs: Fix NULL dereference and leak in the -ENOMEM path References: <4DDA8C3D.5080706@panasas.com> <1306168714-11721-1-git-send-email-bhalevy@panasas.com> <4DDD2933.3000209@panasas.com> In-Reply-To: <4DDD2933.3000209@panasas.com> X-OriginalArrivalTime: 25 May 2011 16:19:46.0094 (UTC) FILETIME=[8FEED4E0:01CC1AF7] Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Wed, 25 May 2011 16:19:53 +0000 (UTC) In _pnfs_return_layout: lrp pointer is checked for NULL after it was already accessed. The rational here is that in _pnfs_return_layout we want to de-ref and release the layout regardless of if we sent the return or not (forgetfull). An eventual recall can return -ENOMATCHING instead of -EDELAY. So to keep the reasoning above, copy the stateid twice. Benny if it is OK to not release the layout on -ENOMEM then the check could just be moved above the spin_lock(), and the put_layout_hdr removed. Also the error returns would leak the lrp so fix it. Signed-off-by: Boaz Harrosh --- fs/nfs/pnfs.c | 14 +++++++++----- 1 files changed, 9 insertions(+), 5 deletions(-) diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c index a07b007..3847406 100644 --- a/fs/nfs/pnfs.c +++ b/fs/nfs/pnfs.c @@ -627,13 +627,12 @@ _pnfs_return_layout(struct inode *ino) struct pnfs_layout_hdr *lo = NULL; struct nfs_inode *nfsi = NFS_I(ino); LIST_HEAD(tmp_list); - struct nfs4_layoutreturn *lrp; + struct nfs4_layoutreturn *lrp = NULL; + nfs4_stateid stateid; int status = 0; dprintk("--> %s\n", __func__); - lrp = kzalloc(sizeof(*lrp), GFP_KERNEL); - spin_lock(&ino->i_lock); lo = nfsi->layout; if (!lo || !mark_matching_lsegs_invalid(lo, &tmp_list, NULL)) { @@ -642,7 +641,7 @@ _pnfs_return_layout(struct inode *ino) kfree(lrp); goto out; } - lrp->args.stateid = nfsi->layout->plh_stateid; + stateid = nfsi->layout->plh_stateid; /* Reference matched in nfs4_layoutreturn_release */ get_layout_hdr(lo); spin_unlock(&ino->i_lock); @@ -650,11 +649,14 @@ _pnfs_return_layout(struct inode *ino) WARN_ON(test_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)); - if (lrp == NULL) { + /* lrp is freed in nfs4_layoutreturn_release */ + lrp = kzalloc(sizeof(*lrp), GFP_KERNEL); + if (unlikely(!lrp)) { put_layout_hdr(NFS_I(ino)->layout); status = -ENOMEM; goto out; } + lrp->args.stateid = stateid; lrp->args.reclaim = 0; lrp->args.layout_type = NFS_SERVER(ino)->pnfs_curr_ld->id; lrp->args.inode = ino; @@ -662,6 +664,8 @@ _pnfs_return_layout(struct inode *ino) status = nfs4_proc_layoutreturn(lrp); out: + if (unlikely(status)) + kfree(lrp); dprintk("<-- %s status: %d\n", __func__, status); return status; }