mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-31 16:38:12 +00:00
ubifs: dbg_check_idx_size: Fix kmemleak if loading znode failed
If function dbg_check_idx_size() failed by loading znode in mounting
process, there are two problems:
1. Allocated znodes won't be freed, which causes kmemleak in kernel:
ubifs_mount
dbg_check_idx_size
dbg_walk_index
c->zroot.znode = ubifs_load_znode
child = ubifs_load_znode // failed
// Loaded znodes won't be freed in error handling path.
2. Global variable ubifs_clean_zn_cnt is not decreased, because
ubifs_tnc_close() is not invoked in error handling path, which
triggers a warning in ubifs_exit():
WARNING: CPU: 1 PID: 1576 at fs/ubifs/super.c:2486 ubifs_exit
Modules linked in: zstd ubifs(-) ubi nandsim
CPU: 1 PID: 1576 Comm: rmmod Not tainted 6.7.0-rc6
Call Trace:
ubifs_exit+0xca/0xc70 [ubifs]
__do_sys_delete_module+0x29a/0x4a0
do_syscall_64+0x6f/0x140
Fix it by adding error handling path in dbg_check_idx_size() to release
tnc tree.
Fixes: 1e51764a3c
("UBIFS: add new flash file system")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Suggested-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Richard Weinberger <richard@nod.at>
This commit is contained in:
parent
9277b3a649
commit
31a9d5f329
4 changed files with 31 additions and 10 deletions
|
@ -1742,17 +1742,22 @@ int dbg_check_idx_size(struct ubifs_info *c, long long idx_size)
|
||||||
err = dbg_walk_index(c, NULL, add_size, &calc);
|
err = dbg_walk_index(c, NULL, add_size, &calc);
|
||||||
if (err) {
|
if (err) {
|
||||||
ubifs_err(c, "error %d while walking the index", err);
|
ubifs_err(c, "error %d while walking the index", err);
|
||||||
return err;
|
goto out_err;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (calc != idx_size) {
|
if (calc != idx_size) {
|
||||||
ubifs_err(c, "index size check failed: calculated size is %lld, should be %lld",
|
ubifs_err(c, "index size check failed: calculated size is %lld, should be %lld",
|
||||||
calc, idx_size);
|
calc, idx_size);
|
||||||
dump_stack();
|
dump_stack();
|
||||||
return -EINVAL;
|
err = -EINVAL;
|
||||||
|
goto out_err;
|
||||||
}
|
}
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
out_err:
|
||||||
|
ubifs_destroy_tnc_tree(c);
|
||||||
|
return err;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
|
@ -3116,14 +3116,7 @@ static void tnc_destroy_cnext(struct ubifs_info *c)
|
||||||
void ubifs_tnc_close(struct ubifs_info *c)
|
void ubifs_tnc_close(struct ubifs_info *c)
|
||||||
{
|
{
|
||||||
tnc_destroy_cnext(c);
|
tnc_destroy_cnext(c);
|
||||||
if (c->zroot.znode) {
|
ubifs_destroy_tnc_tree(c);
|
||||||
long n, freed;
|
|
||||||
|
|
||||||
n = atomic_long_read(&c->clean_zn_cnt);
|
|
||||||
freed = ubifs_destroy_tnc_subtree(c, c->zroot.znode);
|
|
||||||
ubifs_assert(c, freed == n);
|
|
||||||
atomic_long_sub(n, &ubifs_clean_zn_cnt);
|
|
||||||
}
|
|
||||||
kfree(c->gap_lebs);
|
kfree(c->gap_lebs);
|
||||||
kfree(c->ilebs);
|
kfree(c->ilebs);
|
||||||
destroy_old_idx(c);
|
destroy_old_idx(c);
|
||||||
|
|
|
@ -250,6 +250,28 @@ long ubifs_destroy_tnc_subtree(const struct ubifs_info *c,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* ubifs_destroy_tnc_tree - destroy all znodes connected to the TNC tree.
|
||||||
|
* @c: UBIFS file-system description object
|
||||||
|
*
|
||||||
|
* This function destroys the whole TNC tree and updates clean global znode
|
||||||
|
* count.
|
||||||
|
*/
|
||||||
|
void ubifs_destroy_tnc_tree(struct ubifs_info *c)
|
||||||
|
{
|
||||||
|
long n, freed;
|
||||||
|
|
||||||
|
if (!c->zroot.znode)
|
||||||
|
return;
|
||||||
|
|
||||||
|
n = atomic_long_read(&c->clean_zn_cnt);
|
||||||
|
freed = ubifs_destroy_tnc_subtree(c, c->zroot.znode);
|
||||||
|
ubifs_assert(c, freed == n);
|
||||||
|
atomic_long_sub(n, &ubifs_clean_zn_cnt);
|
||||||
|
|
||||||
|
c->zroot.znode = NULL;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* read_znode - read an indexing node from flash and fill znode.
|
* read_znode - read an indexing node from flash and fill znode.
|
||||||
* @c: UBIFS file-system description object
|
* @c: UBIFS file-system description object
|
||||||
|
|
|
@ -1903,6 +1903,7 @@ struct ubifs_znode *ubifs_tnc_postorder_next(const struct ubifs_info *c,
|
||||||
struct ubifs_znode *znode);
|
struct ubifs_znode *znode);
|
||||||
long ubifs_destroy_tnc_subtree(const struct ubifs_info *c,
|
long ubifs_destroy_tnc_subtree(const struct ubifs_info *c,
|
||||||
struct ubifs_znode *zr);
|
struct ubifs_znode *zr);
|
||||||
|
void ubifs_destroy_tnc_tree(struct ubifs_info *c);
|
||||||
struct ubifs_znode *ubifs_load_znode(struct ubifs_info *c,
|
struct ubifs_znode *ubifs_load_znode(struct ubifs_info *c,
|
||||||
struct ubifs_zbranch *zbr,
|
struct ubifs_zbranch *zbr,
|
||||||
struct ubifs_znode *parent, int iip);
|
struct ubifs_znode *parent, int iip);
|
||||||
|
|
Loading…
Reference in a new issue