releases/2.6.32.17/0004-ext4-Eliminate-potential-double-free-on-error-path.patch

   1 From 857855f2523af677951cb3bba61396813df6128d Mon Sep 17 00:00:00 2001
   2 From: Julia Lawall <julia@diku.dk>
   3 Date: Sun, 30 May 2010 22:49:18 -0400
   4 Subject: ext4: Eliminate potential double free on error path
   5
   6 commit d3533d72e7478a61a3e1936956fc825289a2acf4 upstream (as of v2.6.33-rc3)
   7
   8 b_entry_name and buffer are initially NULL, are initialized within a loop
   9 to the result of calling kmalloc, and are freed at the bottom of this loop.
  10 The loop contains gotos to cleanup, which also frees b_entry_name and
  11 buffer.  Some of these gotos are before the reinitializations of
  12 b_entry_name and buffer.  To maintain the invariant that b_entry_name and
  13 buffer are NULL at the top of the loop, and thus acceptable arguments to
  14 kfree, these variables are now set to NULL after the kfrees.
  15
  16 This seems to be the simplest solution.  A more complicated solution
  17 would be to introduce more labels in the error handling code at the end of
  18 the function.
  19
  20 A simplified version of the semantic match that finds this problem is as
  21 follows: (http://coccinelle.lip6.fr/)
  22
  23 // <smpl>
  24 @r@
  25 identifier E;
  26 expression E1;
  27 iterator I;
  28 statement S;
  29 @@
  30
  31 *kfree(E);
  32 ... when != E = E1
  33     when != I(E,...) S
  34     when != &E
  35 *kfree(E);
  36 // </smpl>
  37
  38 Signed-off-by: Julia Lawall <julia@diku.dk>
  39 Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
  40 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  41 ---
  42  fs/ext4/xattr.c |    2 ++
  43  1 file changed, 2 insertions(+)
  44
  45 --- a/fs/ext4/xattr.c
  46 +++ b/fs/ext4/xattr.c
  47 @@ -1327,6 +1327,8 @@ retry:
  48                         goto cleanup;
  49                 kfree(b_entry_name);
  50                 kfree(buffer);
  51 +               b_entry_name = NULL;
  52 +               buffer = NULL;
  53                 brelse(is->iloc.bh);
  54                 kfree(is);
  55                 kfree(bs);