Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f92f2904 authored by Andreas Gruenbacher's avatar Andreas Gruenbacher Committed by Greg Kroah-Hartman
Browse files

nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl 



commit 7648f939cb919b9d15c21fff8cd9eba908d595dc upstream.

nfs3_set_acl keeps track of the acl it allocated locally to determine if an acl
needs to be released at the end.  This results in a memory leak when the
function allocates an acl as well as a default acl.  Fix by releasing acls
that differ from the acl originally passed into nfs3_set_acl.

Fixes: b7fa0554 ("[PATCH] NFS: Add support for NFSv3 ACLs")
Reported-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a4dc992b

fs/nfs/nfs3acl.c

+15 −7
Original line number Diff line number Diff line
@@ -252,37 +252,45 @@ int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl, 


int nfs3_set_acl(struct inode *inode, struct posix_acl *acl, int type)

{

	struct posix_acl *alloc = NULL, *dfacl = NULL;

	struct posix_acl *orig = acl, *dfacl = NULL, *alloc;

	int status;



	if (S_ISDIR(inode->i_mode)) {

		switch(type) {

		case ACL_TYPE_ACCESS:

			alloc = dfacl = get_acl(inode, ACL_TYPE_DEFAULT);

			alloc = get_acl(inode, ACL_TYPE_DEFAULT);

			if (IS_ERR(alloc))

				goto fail;

			dfacl = alloc;

			break;



		case ACL_TYPE_DEFAULT:

			dfacl = acl;

			alloc = acl = get_acl(inode, ACL_TYPE_ACCESS);

			alloc = get_acl(inode, ACL_TYPE_ACCESS);

			if (IS_ERR(alloc))

				goto fail;

			dfacl = acl;

			acl = alloc;

			break;

		}

	}



	if (acl == NULL) {

		alloc = acl = posix_acl_from_mode(inode->i_mode, GFP_KERNEL);

		alloc = posix_acl_from_mode(inode->i_mode, GFP_KERNEL);

		if (IS_ERR(alloc))

			goto fail;

		acl = alloc;

	}

	status = __nfs3_proc_setacls(inode, acl, dfacl);

	posix_acl_release(alloc);

out:

	if (acl != orig)

		posix_acl_release(acl);

	if (dfacl != orig)

		posix_acl_release(dfacl);

	return status;



fail:

	return PTR_ERR(alloc);

	status = PTR_ERR(alloc);

	goto out;

}



const struct xattr_handler *nfs3_xattr_handlers[] = {