lkml.org 
[lkml]   [2019]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 088/105] gfs2: Get rid of potential double-freeing in gfs2_create_inode
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Andreas Gruenbacher <agruenba@redhat.com>

    commit 6ff9b09e00a441599f3aacdf577254455a048bc9 upstream.

    In gfs2_create_inode, after setting and releasing the acl / default_acl, the
    acl / default_acl pointers are not set to NULL as they should be. In that
    state, when the function reaches label fail_free_acls, gfs2_create_inode will
    try to release the same acls again.

    Fix that by setting the pointers to NULL after releasing the acls. Slightly
    simplify the logic. Also, posix_acl_release checks for NULL already, so
    there is no need to duplicate those checks here.

    Fixes: e01580bf9e4d ("gfs2: use generic posix ACL infrastructure")
    Reported-by: Pan Bian <bianpan2016@163.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: stable@vger.kernel.org # v4.9+
    Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
    Signed-off-by: Bob Peterson <rpeterso@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/gfs2/inode.c | 18 +++++++++---------
    1 file changed, 9 insertions(+), 9 deletions(-)

    --- a/fs/gfs2/inode.c
    +++ b/fs/gfs2/inode.c
    @@ -743,17 +743,19 @@ static int gfs2_create_inode(struct inod
    the gfs2 structures. */
    if (default_acl) {
    error = __gfs2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
    + if (error)
    + goto fail_gunlock3;
    posix_acl_release(default_acl);
    + default_acl = NULL;
    }
    if (acl) {
    - if (!error)
    - error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
    + error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
    + if (error)
    + goto fail_gunlock3;
    posix_acl_release(acl);
    + acl = NULL;
    }

    - if (error)
    - goto fail_gunlock3;
    -
    error = security_inode_init_security(&ip->i_inode, &dip->i_inode, name,
    &gfs2_initxattrs, NULL);
    if (error)
    @@ -788,10 +790,8 @@ fail_free_inode:
    }
    gfs2_rsqa_delete(ip, NULL);
    fail_free_acls:
    - if (default_acl)
    - posix_acl_release(default_acl);
    - if (acl)
    - posix_acl_release(acl);
    + posix_acl_release(default_acl);
    + posix_acl_release(acl);
    fail_gunlock:
    gfs2_dir_no_add(&da);
    gfs2_glock_dq_uninit(ghs);

    \
     
     \ /
      Last update: 2019-01-11 16:00    [W:4.130 / U:0.856 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site