dlm: memory leaks on error path in dlm_user_request() (d47b41ac) · Commits · 戴 / test

According to comment in dlm_user_request() ua should be freed in dlm_free_lkb() after successful attach to lkb. However ua is attached to lkb not in set_lock_args() but later, inside request_lock(). Fixes ("[DLM] dlm: user locks") Cc: stable@kernel.org # 2.6.19 Signed-off-by:

Vasily Averin <vvs@virtuozzo.com> Signed-off-by:

David Teigland <teigland@redhat.com>

fs/dlm/lock.c

+7 −7

Original line number	Diff line number	Diff line
		@@ -5795,20 +5795,20 @@ int dlm_user_request(struct dlm_ls ls, struct dlm_user_args ua,
		goto out;
		}
		}

		/* After ua is attached to lkb it will be freed by dlm_free_lkb().
		When DLM_IFL_USER is set, the dlm knows that this is a userspace
		lock and that lkb_astparam is the dlm_user_args structure. */

		error = set_lock_args(mode, &ua->lksb, flags, namelen, timeout_cs,
		fake_astfn, ua, fake_bastfn, &args);
		lkb->lkb_flags \|= DLM_IFL_USER;

		if (error) {
		kfree(ua->lksb.sb_lvbptr);
		ua->lksb.sb_lvbptr = NULL;
		kfree(ua);
		__put_lkb(ls, lkb);
		goto out;
		}

		/* After ua is attached to lkb it will be freed by dlm_free_lkb().
		When DLM_IFL_USER is set, the dlm knows that this is a userspace
		lock and that lkb_astparam is the dlm_user_args structure. */
		lkb->lkb_flags \|= DLM_IFL_USER;
		error = request_lock(ls, lkb, name, namelen, &args);

		switch (error) {

Admin message