lkml.org 
[lkml]   [2020]   [May]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.6 031/126] configfs: fix config_item refcnt leak in configfs_rmdir()
    Date
    From: Xiyu Yang <xiyuyang19@fudan.edu.cn>

    [ Upstream commit 8aebfffacfa379ba400da573a5bf9e49634e38cb ]

    configfs_rmdir() invokes configfs_get_config_item(), which returns a
    reference of the specified config_item object to "parent_item" with
    increased refcnt.

    When configfs_rmdir() returns, local variable "parent_item" becomes
    invalid, so the refcount should be decreased to keep refcount balanced.

    The reference counting issue happens in one exception handling path of
    configfs_rmdir(). When down_write_killable() fails, the function forgets
    to decrease the refcnt increased by configfs_get_config_item(), causing
    a refcnt leak.

    Fix this issue by calling config_item_put() when down_write_killable()
    fails.

    Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/configfs/dir.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
    index cf7b7e1d5bd7..cb733652ecca 100644
    --- a/fs/configfs/dir.c
    +++ b/fs/configfs/dir.c
    @@ -1519,6 +1519,7 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry)
    spin_lock(&configfs_dirent_lock);
    configfs_detach_rollback(dentry);
    spin_unlock(&configfs_dirent_lock);
    + config_item_put(parent_item);
    return -EINTR;
    }
    frag->frag_dead = true;
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-05-26 21:15    [W:4.135 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site