Skip to content

Commit 0d52154

Browse files
Chengguang Xutytso
Chengguang Xu
authored and
tytso
committed
jbd2: fix potential double free
When failing from creating cache jbd2_inode_cache, we will destroy the previously created cache jbd2_handle_cache twice. This patch fixes this by moving each cache initialization/destruction to its own separate, individual function. Signed-off-by: Chengguang Xu <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]> Cc: [email protected]
1 parent 592acbf commit 0d52154

File tree

4 files changed

+61
-36
lines changed

4 files changed

+61
-36
lines changed

‎fs/jbd2/journal.c

Lines changed: 31 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2375,22 +2375,19 @@ static struct kmem_cache *jbd2_journal_head_cache;
23752375
static atomic_t nr_journal_heads = ATOMIC_INIT(0);
23762376
#endif
23772377

2378-
static int jbd2_journal_init_journal_head_cache(void)
2378+
static int __init jbd2_journal_init_journal_head_cache(void)
23792379
{
2380-
int retval;
2381-
2382-
J_ASSERT(jbd2_journal_head_cache == NULL);
2380+
J_ASSERT(!jbd2_journal_head_cache);
23832381
jbd2_journal_head_cache = kmem_cache_create("jbd2_journal_head",
23842382
sizeof(struct journal_head),
23852383
0, /* offset */
23862384
SLAB_TEMPORARY | SLAB_TYPESAFE_BY_RCU,
23872385
NULL); /* ctor */
2388-
retval = 0;
23892386
if (!jbd2_journal_head_cache) {
2390-
retval = -ENOMEM;
23912387
printk(KERN_EMERG "JBD2: no memory for journal_head cache\n");
2388+
return -ENOMEM;
23922389
}
2393-
return retval;
2390+
return 0;
23942391
}
23952392

23962393
static void jbd2_journal_destroy_journal_head_cache(void)
@@ -2636,28 +2633,38 @@ static void __exit jbd2_remove_jbd_stats_proc_entry(void)
26362633

26372634
struct kmem_cache *jbd2_handle_cache, *jbd2_inode_cache;
26382635

2636+
static int __init jbd2_journal_init_inode_cache(void)
2637+
{
2638+
J_ASSERT(!jbd2_inode_cache);
2639+
jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
2640+
if (!jbd2_inode_cache) {
2641+
pr_emerg("JBD2: failed to create inode cache\n");
2642+
return -ENOMEM;
2643+
}
2644+
return 0;
2645+
}
2646+
26392647
static int __init jbd2_journal_init_handle_cache(void)
26402648
{
2649+
J_ASSERT(!jbd2_handle_cache);
26412650
jbd2_handle_cache = KMEM_CACHE(jbd2_journal_handle, SLAB_TEMPORARY);
2642-
if (jbd2_handle_cache == NULL) {
2651+
if (!jbd2_handle_cache) {
26432652
printk(KERN_EMERG "JBD2: failed to create handle cache\n");
26442653
return -ENOMEM;
26452654
}
2646-
jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
2647-
if (jbd2_inode_cache == NULL) {
2648-
printk(KERN_EMERG "JBD2: failed to create inode cache\n");
2649-
kmem_cache_destroy(jbd2_handle_cache);
2650-
return -ENOMEM;
2651-
}
26522655
return 0;
26532656
}
26542657

2658+
static void jbd2_journal_destroy_inode_cache(void)
2659+
{
2660+
kmem_cache_destroy(jbd2_inode_cache);
2661+
jbd2_inode_cache = NULL;
2662+
}
2663+
26552664
static void jbd2_journal_destroy_handle_cache(void)
26562665
{
26572666
kmem_cache_destroy(jbd2_handle_cache);
26582667
jbd2_handle_cache = NULL;
2659-
kmem_cache_destroy(jbd2_inode_cache);
2660-
jbd2_inode_cache = NULL;
26612668
}
26622669

26632670
/*
@@ -2668,21 +2675,27 @@ static int __init journal_init_caches(void)
26682675
{
26692676
int ret;
26702677

2671-
ret = jbd2_journal_init_revoke_caches();
2678+
ret = jbd2_journal_init_revoke_record_cache();
2679+
if (ret == 0)
2680+
ret = jbd2_journal_init_revoke_table_cache();
26722681
if (ret == 0)
26732682
ret = jbd2_journal_init_journal_head_cache();
26742683
if (ret == 0)
26752684
ret = jbd2_journal_init_handle_cache();
2685+
if (ret == 0)
2686+
ret = jbd2_journal_init_inode_cache();
26762687
if (ret == 0)
26772688
ret = jbd2_journal_init_transaction_cache();
26782689
return ret;
26792690
}
26802691

26812692
static void jbd2_journal_destroy_caches(void)
26822693
{
2683-
jbd2_journal_destroy_revoke_caches();
2694+
jbd2_journal_destroy_revoke_record_cache();
2695+
jbd2_journal_destroy_revoke_table_cache();
26842696
jbd2_journal_destroy_journal_head_cache();
26852697
jbd2_journal_destroy_handle_cache();
2698+
jbd2_journal_destroy_inode_cache();
26862699
jbd2_journal_destroy_transaction_cache();
26872700
jbd2_journal_destroy_slabs();
26882701
}

‎fs/jbd2/revoke.c

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -178,33 +178,41 @@ static struct jbd2_revoke_record_s *find_revoke_record(journal_t *journal,
178178
return NULL;
179179
}
180180

181-
void jbd2_journal_destroy_revoke_caches(void)
181+
void jbd2_journal_destroy_revoke_record_cache(void)
182182
{
183183
kmem_cache_destroy(jbd2_revoke_record_cache);
184184
jbd2_revoke_record_cache = NULL;
185+
}
186+
187+
void jbd2_journal_destroy_revoke_table_cache(void)
188+
{
185189
kmem_cache_destroy(jbd2_revoke_table_cache);
186190
jbd2_revoke_table_cache = NULL;
187191
}
188192

189-
int __init jbd2_journal_init_revoke_caches(void)
193+
int __init jbd2_journal_init_revoke_record_cache(void)
190194
{
191195
J_ASSERT(!jbd2_revoke_record_cache);
192-
J_ASSERT(!jbd2_revoke_table_cache);
193-
194196
jbd2_revoke_record_cache = KMEM_CACHE(jbd2_revoke_record_s,
195197
SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY);
196-
if (!jbd2_revoke_record_cache)
197-
goto record_cache_failure;
198198

199+
if (!jbd2_revoke_record_cache) {
200+
pr_emerg("JBD2: failed to create revoke_record cache\n");
201+
return -ENOMEM;
202+
}
203+
return 0;
204+
}
205+
206+
int __init jbd2_journal_init_revoke_table_cache(void)
207+
{
208+
J_ASSERT(!jbd2_revoke_table_cache);
199209
jbd2_revoke_table_cache = KMEM_CACHE(jbd2_revoke_table_s,
200210
SLAB_TEMPORARY);
201-
if (!jbd2_revoke_table_cache)
202-
goto table_cache_failure;
203-
return 0;
204-
table_cache_failure:
205-
jbd2_journal_destroy_revoke_caches();
206-
record_cache_failure:
211+
if (!jbd2_revoke_table_cache) {
212+
pr_emerg("JBD2: failed to create revoke_table cache\n");
207213
return -ENOMEM;
214+
}
215+
return 0;
208216
}
209217

210218
static struct jbd2_revoke_table_s *jbd2_journal_init_revoke_table(int hash_size)

‎fs/jbd2/transaction.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,11 @@ int __init jbd2_journal_init_transaction_cache(void)
4242
0,
4343
SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY,
4444
NULL);
45-
if (transaction_cache)
46-
return 0;
47-
return -ENOMEM;
45+
if (!transaction_cache) {
46+
pr_emerg("JBD2: failed to create transaction cache\n");
47+
return -ENOMEM;
48+
}
49+
return 0;
4850
}
4951

5052
void jbd2_journal_destroy_transaction_cache(void)

‎include/linux/jbd2.h

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1318,7 +1318,7 @@ extern void __wait_on_journal (journal_t *);
13181318

13191319
/* Transaction cache support */
13201320
extern void jbd2_journal_destroy_transaction_cache(void);
1321-
extern int jbd2_journal_init_transaction_cache(void);
1321+
extern int __init jbd2_journal_init_transaction_cache(void);
13221322
extern void jbd2_journal_free_transaction(transaction_t *);
13231323

13241324
/*
@@ -1446,8 +1446,10 @@ static inline void jbd2_free_inode(struct jbd2_inode *jinode)
14461446
/* Primary revoke support */
14471447
#define JOURNAL_REVOKE_DEFAULT_HASH 256
14481448
extern int jbd2_journal_init_revoke(journal_t *, int);
1449-
extern void jbd2_journal_destroy_revoke_caches(void);
1450-
extern int jbd2_journal_init_revoke_caches(void);
1449+
extern void jbd2_journal_destroy_revoke_record_cache(void);
1450+
extern void jbd2_journal_destroy_revoke_table_cache(void);
1451+
extern int __init jbd2_journal_init_revoke_record_cache(void);
1452+
extern int __init jbd2_journal_init_revoke_table_cache(void);
14511453

14521454
extern void jbd2_journal_destroy_revoke(journal_t *);
14531455
extern int jbd2_journal_revoke (handle_t *, unsigned long long, struct buffer_head *);

0 commit comments

Comments
 (0)