linux-kernel - Re: [PATCH] fs/iomap: fix memory leak on error condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180221215605.GK6778@dastard>
Date:   Thu, 22 Feb 2018 08:56:05 +1100
From:   Dave Chinner <david@...morbit.com>
To:     Garry McNulty <garrmcnu@...il.com>
Cc:     linux-fsdevel@...r.kernel.org, viro@...iv.linux.org.uk, hch@....de,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] fs/iomap: fix memory leak on error condition

On Wed, Feb 21, 2018 at 08:41:28PM +0000, Garry McNulty wrote:
> If the call to is_sync_kiocb() fails an error is returned without
> freeing dio. Set the return code and jump to out_free_dio.
> 
> Detected by CoverityScan, CID 1429424 ("Resource leak")

Coverity is wrong.

> Signed-off-by: Garry McNulty <garrmcnu@...il.com>
> ---
>  fs/iomap.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/iomap.c b/fs/iomap.c
> index afd163586aa0..65c5db38c15a 100644
> --- a/fs/iomap.c
> +++ b/fs/iomap.c
> @@ -1063,8 +1063,10 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
>  		iomap_dio_set_error(dio, ret);
>  
>  	if (!atomic_dec_and_test(&dio->ref)) {
> -		if (!is_sync_kiocb(iocb))
> -			return -EIOCBQUEUED;
> +		if (!is_sync_kiocb(iocb)) {
> +			ret = -EIOCBQUEUED;
> +			goto out_free_dio;
> +		}

This is where we return after AIO submission. The struct dio has
already been attached to the bio we have submitted, and will be
freed on IO completion.  We are simply not waiting for IO completion
here, instead leaving it to the completion code to free the struct
dio and pass the completion status to the AIO code appropriately.

Cheers,

Dave.
-- 
Dave Chinner
david@...morbit.com