From patchwork Fri Nov 23 10:41:57 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Kent X-Patchwork-Id: 10695569 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EEC9913AD for ; Fri, 23 Nov 2018 10:42:07 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DE6F42C05F for ; Fri, 23 Nov 2018 10:42:07 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D2CA52C58E; Fri, 23 Nov 2018 10:42:07 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 79C4E2C05F for ; Fri, 23 Nov 2018 10:42:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2409430AbeKWVZq (ORCPT ); Fri, 23 Nov 2018 16:25:46 -0500 Received: from icp-osb-irony-out4.external.iinet.net.au ([203.59.1.220]:13399 "EHLO icp-osb-irony-out4.external.iinet.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390243AbeKWVZq (ORCPT ); Fri, 23 Nov 2018 16:25:46 -0500 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A2ANAACP2Pdb/7650XYNVRwBAQEEAQEHBAEBgVEHAQELAYQSg3mIGIxJAQEBAQEBBoEQg2eFV4krhHeBeoR0AwIChDU0CQ0BAwEBAQEBAQKGUgIBAyMEIDIQGAEMAiYCAkcQBhOFFqY7cHwzGoMQhm2BC4FziSJ4gQeBETOKYYJXAokfhj0zj3MJkUcKAolpA4cQLIJMln6CDU0uCoMngicXjilljSgBAQ X-IPAS-Result: A2ANAACP2Pdb/7650XYNVRwBAQEEAQEHBAEBgVEHAQELAYQSg3mIGIxJAQEBAQEBBoEQg2eFV4krhHeBeoR0AwIChDU0CQ0BAwEBAQEBAQKGUgIBAyMEIDIQGAEMAiYCAkcQBhOFFqY7cHwzGoMQhm2BC4FziSJ4gQeBETOKYYJXAokfhj0zj3MJkUcKAolpA4cQLIJMln6CDU0uCoMngicXjilljSgBAQ X-IronPort-AV: E=Sophos;i="5.56,269,1539619200"; d="scan'208";a="122563350" Received: from unknown (HELO [192.168.1.28]) ([118.209.185.190]) by icp-osb-irony-out4.iinet.net.au with ESMTP; 23 Nov 2018 18:41:59 +0800 Subject: [PATCH v2 2/5] autofs - fix possible inode leak in autofs_fill_super() From: Ian Kent To: Andrew Morton Cc: Al Viro , autofs mailing list , linux-fsdevel , Kernel Mailing List Date: Fri, 23 Nov 2018 18:41:57 +0800 Message-ID: <154296971705.9889.9822861969081020188.stgit@pluto-themaw-net> In-Reply-To: <154296962626.9889.644199825100770992.stgit@pluto-themaw-net> References: <154296962626.9889.644199825100770992.stgit@pluto-themaw-net> User-Agent: StGit/unknown-version MIME-Version: 1.0 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP There is no check at all for a failure to allocate the root inode in autofs_fill_super(), handle it. Signed-off-by: Ian Kent --- fs/autofs/inode.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c index 846c052569dd..e5c06b5a7371 100644 --- a/fs/autofs/inode.c +++ b/fs/autofs/inode.c @@ -254,9 +254,13 @@ int autofs_fill_super(struct super_block *s, void *data, int silent) goto fail_free; } root_inode = autofs_get_inode(s, S_IFDIR | 0755); + if (!root_inode) { + ret = -ENOMEM; + goto fail_ino; + } root = d_make_root(root_inode); if (!root) - goto fail_ino; + goto fail_iput; pipe = NULL; root->d_fsdata = ino; @@ -304,8 +308,8 @@ int autofs_fill_super(struct super_block *s, void *data, int silent) root_inode->i_op = &autofs_dir_inode_operations; pr_debug("pipe fd = %d, pgrp = %u\n", pipefd, pid_nr(sbi->oz_pgrp)); - pipe = fget(pipefd); + pipe = fget(pipefd); if (!pipe) { pr_err("could not open pipe file descriptor\n"); goto fail_put_pid; @@ -334,6 +338,8 @@ int autofs_fill_super(struct super_block *s, void *data, int silent) fail_dput: dput(root); goto fail_free; +fail_iput: + iput(root_inode); fail_ino: autofs_free_ino(ino); fail_free: