lkml.org 
[lkml]   [2020]   [Jun]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.7 281/376] ext4: fix buffer_head refcnt leak when ext4_iget() fails
    Date
    From: Xiyu Yang <xiyuyang19@fudan.edu.cn>

    commit 3bbd0ef26098d241dc59ee77ba14b7dab0df0786 upstream.

    ext4_orphan_get() invokes ext4_read_inode_bitmap(), which returns a
    reference of the specified buffer_head object to "bitmap_bh" with
    increased refcnt.

    When ext4_orphan_get() returns, local variable "bitmap_bh" becomes
    invalid, so the refcount should be decreased to keep refcount balanced.

    The reference counting issue happens in one exception handling path of
    ext4_orphan_get(). When ext4_iget() fails, the function forgets to
    decrease the refcnt increased by ext4_read_inode_bitmap(), causing a
    refcnt leak.

    Fix this issue by calling brelse() when ext4_iget() fails.

    Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
    Cc: stable@kernel.org
    Link: https://lore.kernel.org/r/1587618568-13418-1-git-send-email-xiyuyang19@fudan.edu.cn
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/ext4/ialloc.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/fs/ext4/ialloc.c
    +++ b/fs/ext4/ialloc.c
    @@ -1246,6 +1246,7 @@ struct inode *ext4_orphan_get(struct sup
    ext4_error_err(sb, -err,
    "couldn't read orphan inode %lu (err %d)",
    ino, err);
    + brelse(bitmap_bh);
    return inode;
    }


    \
     
     \ /
      Last update: 2020-06-19 17:38    [W:4.141 / U:1.284 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site