Commit 6ff9b09e authored Nov 26, 2018 by Andreas Gruenbacher

gfs2: Get rid of potential double-freeing in gfs2_create_inode



In gfs2_create_inode, after setting and releasing the acl / default_acl, the
acl / default_acl pointers are not set to NULL as they should be.  In that
state, when the function reaches label fail_free_acls, gfs2_create_inode will
try to release the same acls again.

Fix that by setting the pointers to NULL after releasing the acls.  Slightly
simplify the logic.  Also, posix_acl_release checks for NULL already, so
there is no need to duplicate those checks here.

Fixes: e01580bf ("gfs2: use generic posix ACL infrastructure")
Reported-by: Pan Bian <bianpan2016@163.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Bob Peterson <rpeterso@redhat.com>

parent cbbe76c8

fs/gfs2/inode.c

+9 −9

Original line number	Diff line number	Diff line
		@@ -744,16 +744,18 @@ static int gfs2_create_inode(struct inode dir, struct dentry dentry,
		the gfs2 structures. */
		if (default_acl) {
		error = __gfs2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
		if (error)
		goto fail_gunlock3;
		posix_acl_release(default_acl);
		default_acl = NULL;
		}
		if (acl) {
		if (!error)
		error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
		posix_acl_release(acl);
		}

		if (error)
		goto fail_gunlock3;
		posix_acl_release(acl);
		acl = NULL;
		}

		error = security_inode_init_security(&ip->i_inode, &dip->i_inode, name,
		&gfs2_initxattrs, NULL);
		@@ -789,9 +791,7 @@ fail_free_inode:
		}
		gfs2_rsqa_delete(ip, NULL);
		fail_free_acls:
		if (default_acl)
		posix_acl_release(default_acl);
		if (acl)
		posix_acl_release(acl);
		fail_gunlock:
		gfs2_dir_no_add(&da);

Admin message