xfs: don't leak the retained da state when doing a leaf to node conversion

Source kernel commit: a618acab136b1b01a4c10957ce8bae70cc9f7ca4

If a setxattr operation finds an xattr structure in leaf format, adding
the attr can fail due to lack of space and hence requires an upgrade to
node format.  After this happens, we'll roll the transaction and
re-enter the state machine, at which time we need to perform a second
lookup of the attribute name to find its new location.  This lookup
attaches a new da state structure to the xfs_attr_item but doesn't free
the old one (from the leaf lookup) and leaks it.  Fix that.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>

diff --git a/libxfs/xfs_attr.c b/libxfs/xfs_attr.c
index a33490eeeced6db1b5eadace00a34e1fcb9a352b..4995ff87a241e4a2d8d94634484970ce165b4a6e 100644 (file)
--- a/libxfs/xfs_attr.c
+++ b/libxfs/xfs_attr.c
@@ -1399,8 +1399,10 @@ xfs_attr_node_hasname(
        int                     retval, error;
 
        state = xfs_da_state_alloc(args);
-       if (statep != NULL)
+       if (statep != NULL) {
+               ASSERT(*statep == NULL);
                *statep = state;
+       }
 
        /*
         * Search to see if name exists, and get back a pointer to it.
@@ -1426,6 +1428,10 @@ xfs_attr_node_addname_find_attr(
        struct xfs_da_args      *args = attr->xattri_da_args;
        int                     error;
 
+       if (attr->xattri_da_state)
+               xfs_da_state_free(attr->xattri_da_state);
+       attr->xattri_da_state = NULL;
+
        /*
         * Search to see if name already exists, and get back a pointer
         * to where it should go.
@@ -1591,7 +1597,7 @@ STATIC int
 xfs_attr_node_get(
        struct xfs_da_args      *args)
 {
-       struct xfs_da_state     *state;
+       struct xfs_da_state     *state = NULL;
        struct xfs_da_state_blk *blk;
        int                     i;
        int                     error;