linux-kernel - Re: [PATCH] posix_acl: fix reference leaks in posix_acl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 1 Feb 2015 23:55:02 -0800
From:	Omar Sandoval <osandov@...ndov.com>
To:	Christoph Hellwig <hch@....de>
Cc:	Alexander Viro <viro@...iv.linux.org.uk>,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] posix_acl: fix reference leaks in posix_acl_create

On Wed, Jan 28, 2015 at 06:09:52PM +0100, Christoph Hellwig wrote:
> On Mon, Jan 26, 2015 at 10:16:53PM -0800, Omar Sandoval wrote:
> > get_acl gets a reference which we must release in the error cases.
> > 
> > Signed-off-by: Omar Sandoval <osandov@...ndov.com>
> 
> Looks good, but at this point goto-based unwinding might be in order.

Hi, Christoph,

There are already a couple of return paths in posix_acl_create, and
there are only these two error cases, so I think gotos might actually
make the code more confusing. In any case, here's an idea:

posix_acl: fix reference leaks in posix_acl_create

get_acl gets a reference which we must release in the error cases.

Signed-off-by: Omar Sandoval <osandov@...ndov.com>

diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 0855f77..515d315 100644
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -564,13 +564,11 @@ posix_acl_create(struct inode *dir, umode_t *mode,

        *acl = posix_acl_clone(p, GFP_NOFS);
        if (!*acl)
-               return -ENOMEM;
+               goto no_mem;

        ret = posix_acl_create_masq(*acl, mode);
-       if (ret < 0) {
-               posix_acl_release(*acl);
-               return -ENOMEM;
-       }
+       if (ret < 0)
+               goto no_mem_clone;

        if (ret == 0) {
                posix_acl_release(*acl);
@@ -591,6 +589,12 @@ no_acl:
        *default_acl = NULL;
        *acl = NULL;
        return 0;
+
+no_mem_clone:
+       posix_acl_release(*acl);
+no_mem:
+       posix_acl_release(p);
+       return -ENOMEM;
 }
 EXPORT_SYMBOL_GPL(posix_acl_create);

-- 
Omar
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/