On Mon, 6 Feb 2012, Dave Chinner wrote:

quoted

On Sun, Feb 05, 2012 at 10:23:44PM +0100, Jesper Juhl wrote:

quoted

In xfs_setattr_nonsize(), xfs_trans_alloc() gets its memory from
_xfs_trans_alloc() which gets it from kmem_zone_zalloc() which may
fail and return NULL. So this:

	tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE);

may result in a NULL 'tp'.
If it does, then the call:

	error = xfs_trans_reserve(tp, 0, XFS_ICHANGE_LOG_RES(mp), 0, 0, 0);

with a NULL 'tp' will explode, since xfs_trans_reserve() dereferences
its first argument unconditionally.

xfs_trans_alloc() can't fail. It will sleep forever until the memory
allocation succeeds.

There's 35 other places in XFS where this xfs_trans_alloc/
xfs_trans_reserve pattern occurs - none of them check whether tp is
null, either.

quoted

And if the memory allocation for 'tp' goes well (and thus
xfs_trans_reserve() does not explode) then we may leak the memory
allocated to 'tp' if xfs_trans_reserve() returns error.

yes, that's a problem, though will only happen if a filesystem
shutdown occurs between the start of the function and that check.

quoted

I believe this patch should fix both issues, but I'm not intimate with
the XFS code at all, so there can easily be something I overlooked or
something that should be done differently than what I did.

Only need to fix the leak of tp.

Ok.
Thank you for the detailed explanation.
I believe the patch below should do the trick.


From: Jesper Juhl <redacted>
Date: Sun, 5 Feb 2012 22:11:30 +0100
Subject: [PATCH] XFS: Fix mem leak in xfs_setattr_nonsize()

If the memory allocation for 'tp' goes well then we will leak the
memory allocated to 'tp' if xfs_trans_reserve() returns error.

Signed-off-by: Jesper Juhl <redacted>
---
 fs/xfs/xfs_iops.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index ab30253..2fc1600 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c

@@ -576,8 +576,10 @@ xfs_setattr_nonsize(
 
 	tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE);
 	error = xfs_trans_reserve(tp, 0, XFS_ICHANGE_LOG_RES(mp), 0, 0, 0);
-	if (error)
+	if (error) {
+		xfs_trans_cancel(tp, 0);
 		goto out_dqrele;
+	}
 
 	xfs_ilock(ip, XFS_ILOCK_EXCL);