| Message ID | d8af52e13f53dcb14d72486d6ac92607d5f42716.1662009844.git.christophe.jaillet@wanadoo.fr (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2,1/3] nfsd: Fix a memory leak in an error handling path | expand |
On Thu, 2022-09-01 at 07:27 +0200, Christophe JAILLET wrote: > Propagate the error code returned by memdup_user() instead of a hard coded > -EFAULT. > > Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> > --- > This patch is speculative. The whole call chains have not been checked to > see if there was no path explicitly expecting a -EFAULT. > --- > fs/nfsd/nfs4recover.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c > index 2968cf604e3b..78b8cd9651d5 100644 > --- a/fs/nfsd/nfs4recover.c > +++ b/fs/nfsd/nfs4recover.c > @@ -808,7 +808,7 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, > return -EFAULT; > name.data = memdup_user(&ci->cc_name.cn_id, namelen); > if (IS_ERR(name.data)) > - return -EFAULT; > + return PTR_ERR(name.data); > name.len = namelen; > get_user(princhashlen, &ci->cc_princhash.cp_len); > if (princhashlen > 0) { > @@ -817,7 +817,7 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, > princhashlen); > if (IS_ERR(princhash.data)) { > kfree(name.data); > - return -EFAULT; > + return PTR_ERR(princhash.data); > } > princhash.len = princhashlen; > } else > @@ -830,7 +830,7 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, > return -EFAULT; > name.data = memdup_user(&cnm->cn_id, namelen); > if (IS_ERR(name.data)) > - return -EFAULT; > + return PTR_ERR(name.data); > name.len = namelen; > } > if (name.len > 5 && memcmp(name.data, "hash:", 5) == 0) { I *think* this error gets propagated to userland on a write to rpc_pipefs, and the callers already handle a variety of errors. This looks reasonable to me. Reviewed-by: Jeff Layton <jlayton@kernel.org>
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c index 2968cf604e3b..78b8cd9651d5 100644 --- a/fs/nfsd/nfs4recover.c +++ b/fs/nfsd/nfs4recover.c @@ -808,7 +808,7 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, return -EFAULT; name.data = memdup_user(&ci->cc_name.cn_id, namelen); if (IS_ERR(name.data)) - return -EFAULT; + return PTR_ERR(name.data); name.len = namelen; get_user(princhashlen, &ci->cc_princhash.cp_len); if (princhashlen > 0) { @@ -817,7 +817,7 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, princhashlen); if (IS_ERR(princhash.data)) { kfree(name.data); - return -EFAULT; + return PTR_ERR(princhash.data); } princhash.len = princhashlen; } else @@ -830,7 +830,7 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, return -EFAULT; name.data = memdup_user(&cnm->cn_id, namelen); if (IS_ERR(name.data)) - return -EFAULT; + return PTR_ERR(name.data); name.len = namelen; } if (name.len > 5 && memcmp(name.data, "hash:", 5) == 0) {
Propagate the error code returned by memdup_user() instead of a hard coded -EFAULT. Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> --- This patch is speculative. The whole call chains have not been checked to see if there was no path explicitly expecting a -EFAULT. --- fs/nfsd/nfs4recover.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)