From patchwork Mon Jul 11 15:26:56 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tao Ma X-Patchwork-Id: 104239 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id AD5B1B6F18 for ; Tue, 12 Jul 2011 01:27:17 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757867Ab1GKP1Q (ORCPT ); Mon, 11 Jul 2011 11:27:16 -0400 Received: from oproxy8-pub.bluehost.com ([69.89.22.20]:45398 "HELO oproxy8-pub.bluehost.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1757782Ab1GKP1Q (ORCPT ); Mon, 11 Jul 2011 11:27:16 -0400 Received: (qmail 28105 invoked by uid 0); 11 Jul 2011 15:27:15 -0000 Received: from unknown (HELO box585.bluehost.com) (66.147.242.185) by oproxy8.bluehost.com with SMTP; 11 Jul 2011 15:27:15 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=tao.ma; h=Received:From:To:Cc:Subject:Date:Message-Id:X-Mailer:In-Reply-To:References:X-Identified-User; b=XZgiLgd0jFCdNhsEb8zezj9dEpxGuzNA+YuJ667KRjinXPABF0qTz5BQkCbXDlNoXA9oeyR6s2Df2OfIb3rIc03acbwZmGO9PqhanFQI83DFR4AHAzDIgnQNpfBtZAtJ; Received: from [114.245.226.229] (helo=taoma-laptop2.localdomain6) by box585.bluehost.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from ) id 1QgIO9-0004xR-M1; Mon, 11 Jul 2011 09:27:15 -0600 From: Tao Ma To: linux-ext4@vger.kernel.org Cc: tytso@mit.edu Subject: [PATCH] ext4: Fix a double free of sbi->s_group_info in ext4_mb_init_backend Date: Mon, 11 Jul 2011 23:26:56 +0800 Message-Id: <1310398016-8104-2-git-send-email-tm@tao.ma> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1310398016-8104-1-git-send-email-tm@tao.ma> References: <1310398016-8104-1-git-send-email-tm@tao.ma> X-Identified-User: {1390:box585.bluehost.com:colyli:tao.ma} {sentby:smtp auth 114.245.226.229 authed with tm@tao.ma} Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org From: Tao Ma If we meet with an error in ext4_mb_add_groupinfo, we kfree sbi->s_group_info[group >> EXT4_DESC_PER_BLOCK_BITS(sb)], but fail to reset it to NULL. So the caller ext4_mb_init_backend will try to kfree it again and causes a double free. So fix it by resetting it to NULL. Some typo in comments of mballoc.c are also changed. Signed-off-by: Tao Ma --- fs/ext4/mballoc.c | 12 +++++++----- 1 files changed, 7 insertions(+), 5 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index c680641..4e7d055 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -75,8 +75,8 @@ * * The inode preallocation space is used looking at the _logical_ start * block. If only the logical file block falls within the range of prealloc - * space we will consume the particular prealloc space. This make sure that - * that the we have contiguous physical blocks representing the file blocks + * space we will consume the particular prealloc space. This makes sure that + * we have contiguous physical blocks representing the file blocks * * The important thing to be noted in case of inode prealloc space is that * we don't modify the values associated to inode prealloc space except @@ -84,7 +84,7 @@ * * If we are not able to find blocks in the inode prealloc space and if we * have the group allocation flag set then we look at the locality group - * prealloc space. These are per CPU prealloc list repreasented as + * prealloc space. These are per CPU prealloc list represented as * * ext4_sb_info.s_locality_groups[smp_processor_id()] * @@ -152,7 +152,7 @@ * best extent in the found extents. Searching for the blocks starts with * the group specified as the goal value in allocation context via * ac_g_ex. Each group is first checked based on the criteria whether it - * can used for allocation. ext4_mb_good_group explains how the groups are + * can be used for allocation. ext4_mb_good_group explains how the groups are * checked. * * Both the prealloc space are getting populated as above. So for the first @@ -2279,8 +2279,10 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group, exit_group_info: /* If a meta_group_info table has been allocated, release it now */ - if (group % EXT4_DESC_PER_BLOCK(sb) == 0) + if (group % EXT4_DESC_PER_BLOCK(sb) == 0) { kfree(sbi->s_group_info[group >> EXT4_DESC_PER_BLOCK_BITS(sb)]); + sbi->s_group_info[group >> EXT4_DESC_PER_BLOCK_BITS(sb)] = NULL; + } exit_meta_group_info: return -ENOMEM; } /* ext4_mb_add_groupinfo */