Skip to content

Commit

Permalink
jffs2: Fix in-core inode leaks on error paths
Browse files Browse the repository at this point in the history 
Pointed out by Al Viro.

Signed-off-by: David Woodhouse <[email protected]>
  • Loading branch information
David Woodhouse authored and David Woodhouse committed Jun 3, 2010
1 parent 5869d2c commit f324e4c
Showing 1 changed file with 56 additions and 59 deletions.
115 changes: 56 additions & 59 deletions fs/jffs2/dir.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -360,8 +360,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
/* Eeek. Wave bye bye */
mutex_unlock(&f->sem);
jffs2_complete_reservation(c);
jffs2_clear_inode(inode);
return PTR_ERR(fn);
ret = PTR_ERR(fn);
goto fail;
}

/* We use f->target field to store the target path. */
Expand All @@ -370,8 +370,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
printk(KERN_WARNING "Can't allocate %d bytes of memory\n", targetlen + 1);
mutex_unlock(&f->sem);
jffs2_complete_reservation(c);
jffs2_clear_inode(inode);
return -ENOMEM;
ret = -ENOMEM;
goto fail;
}

memcpy(f->target, target, targetlen + 1);
Expand All @@ -386,30 +386,24 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
jffs2_complete_reservation(c);

ret = jffs2_init_security(inode, dir_i);
if (ret) {
jffs2_clear_inode(inode);
return ret;
}
if (ret)
goto fail;

ret = jffs2_init_acl_post(inode);
if (ret) {
jffs2_clear_inode(inode);
return ret;
}
if (ret)
goto fail;

ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
if (ret) {
/* Eep. */
jffs2_clear_inode(inode);
return ret;
}
if (ret)
goto fail;

rd = jffs2_alloc_raw_dirent();
if (!rd) {
/* Argh. Now we treat it like a normal delete */
jffs2_complete_reservation(c);
jffs2_clear_inode(inode);
return -ENOMEM;
ret = -ENOMEM;
goto fail;
}

dir_f = JFFS2_INODE_INFO(dir_i);
Expand Down Expand Up @@ -437,8 +431,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
jffs2_complete_reservation(c);
jffs2_free_raw_dirent(rd);
mutex_unlock(&dir_f->sem);
jffs2_clear_inode(inode);
return PTR_ERR(fd);
ret = PTR_ERR(fd);
goto fail;
}

dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
Expand All @@ -454,6 +448,11 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char

d_instantiate(dentry, inode);
return 0;

fail:
make_bad_inode(inode);
iput(inode);
return ret;
}


Expand Down Expand Up @@ -519,8 +518,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
/* Eeek. Wave bye bye */
mutex_unlock(&f->sem);
jffs2_complete_reservation(c);
jffs2_clear_inode(inode);
return PTR_ERR(fn);
ret = PTR_ERR(fn);
goto fail;
}
/* No data here. Only a metadata node, which will be
obsoleted by the first data write
Expand All @@ -531,30 +530,24 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
jffs2_complete_reservation(c);

ret = jffs2_init_security(inode, dir_i);
if (ret) {
jffs2_clear_inode(inode);
return ret;
}
if (ret)
goto fail;

ret = jffs2_init_acl_post(inode);
if (ret) {
jffs2_clear_inode(inode);
return ret;
}
if (ret)
goto fail;

ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
if (ret) {
/* Eep. */
jffs2_clear_inode(inode);
return ret;
}
if (ret)
goto fail;

rd = jffs2_alloc_raw_dirent();
if (!rd) {
/* Argh. Now we treat it like a normal delete */
jffs2_complete_reservation(c);
jffs2_clear_inode(inode);
return -ENOMEM;
ret = -ENOMEM;
goto fail;
}

dir_f = JFFS2_INODE_INFO(dir_i);
Expand Down Expand Up @@ -582,8 +575,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
jffs2_complete_reservation(c);
jffs2_free_raw_dirent(rd);
mutex_unlock(&dir_f->sem);
jffs2_clear_inode(inode);
return PTR_ERR(fd);
ret = PTR_ERR(fd);
goto fail;
}

dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
Expand All @@ -600,6 +593,11 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)

d_instantiate(dentry, inode);
return 0;

fail:
make_bad_inode(inode);
iput(inode);
return ret;
}

static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry)
Expand Down Expand Up @@ -693,8 +691,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
/* Eeek. Wave bye bye */
mutex_unlock(&f->sem);
jffs2_complete_reservation(c);
jffs2_clear_inode(inode);
return PTR_ERR(fn);
ret = PTR_ERR(fn);
goto fail;
}
/* No data here. Only a metadata node, which will be
obsoleted by the first data write
Expand All @@ -705,30 +703,24 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
jffs2_complete_reservation(c);

ret = jffs2_init_security(inode, dir_i);
if (ret) {
jffs2_clear_inode(inode);
return ret;
}
if (ret)
goto fail;

ret = jffs2_init_acl_post(inode);
if (ret) {
jffs2_clear_inode(inode);
return ret;
}
if (ret)
goto fail;

ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
if (ret) {
/* Eep. */
jffs2_clear_inode(inode);
return ret;
}
if (ret)
goto fail;

rd = jffs2_alloc_raw_dirent();
if (!rd) {
/* Argh. Now we treat it like a normal delete */
jffs2_complete_reservation(c);
jffs2_clear_inode(inode);
return -ENOMEM;
ret = -ENOMEM;
goto fail;
}

dir_f = JFFS2_INODE_INFO(dir_i);
Expand Down Expand Up @@ -759,8 +751,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
jffs2_complete_reservation(c);
jffs2_free_raw_dirent(rd);
mutex_unlock(&dir_f->sem);
jffs2_clear_inode(inode);
return PTR_ERR(fd);
ret = PTR_ERR(fd);
goto fail;
}

dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
Expand All @@ -777,6 +769,11 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
d_instantiate(dentry, inode);

return 0;

fail:
make_bad_inode(inode);
iput(inode);
return ret;
}

static int jffs2_rename (struct inode *old_dir_i, struct dentry *old_dentry,
Expand Down

0 comments on commit f324e4c

Please sign in to comment.