Commit 31a9d5f3 authored by Zhihao Cheng's avatar Zhihao Cheng Committed by Richard Weinberger
Browse files

ubifs: dbg_check_idx_size: Fix kmemleak if loading znode failed 



If function dbg_check_idx_size() failed by loading znode in mounting
process, there are two problems:
  1. Allocated znodes won't be freed, which causes kmemleak in kernel:
     ubifs_mount
      dbg_check_idx_size
       dbg_walk_index
        c->zroot.znode = ubifs_load_znode
	child = ubifs_load_znode // failed
	// Loaded znodes won't be freed in error handling path.
  2. Global variable ubifs_clean_zn_cnt is not decreased, because
     ubifs_tnc_close() is not invoked in error handling path, which
     triggers a warning in ubifs_exit():
      WARNING: CPU: 1 PID: 1576 at fs/ubifs/super.c:2486 ubifs_exit
      Modules linked in: zstd ubifs(-) ubi nandsim
      CPU: 1 PID: 1576 Comm: rmmod Not tainted 6.7.0-rc6
      Call Trace:
	ubifs_exit+0xca/0xc70 [ubifs]
	__do_sys_delete_module+0x29a/0x4a0
	do_syscall_64+0x6f/0x140

Fix it by adding error handling path in dbg_check_idx_size() to release
tnc tree.

Fixes: 1e51764a ("UBIFS: add new flash file system")
Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
Suggested-by: default avatarRichard Weinberger <richard@nod.at>
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
parent 9277b3a6

fs/ubifs/debug.c

+7 −2
Original line number Diff line number Diff line
@@ -1742,17 +1742,22 @@ int dbg_check_idx_size(struct ubifs_info *c, long long idx_size) 
	err = dbg_walk_index(c, NULL, add_size, &calc);

	if (err) {

		ubifs_err(c, "error %d while walking the index", err);

		return err;

		goto out_err;

	}



	if (calc != idx_size) {

		ubifs_err(c, "index size check failed: calculated size is %lld, should be %lld",

			  calc, idx_size);

		dump_stack();

		return -EINVAL;

		err = -EINVAL;

		goto out_err;

	}



	return 0;



out_err:

	ubifs_destroy_tnc_tree(c);

	return err;

}



/**

fs/ubifs/tnc.c

+1 −8
Original line number Diff line number Diff line
@@ -3116,14 +3116,7 @@ static void tnc_destroy_cnext(struct ubifs_info *c) 
void ubifs_tnc_close(struct ubifs_info *c)

{

	tnc_destroy_cnext(c);

	if (c->zroot.znode) {

		long n, freed;



		n = atomic_long_read(&c->clean_zn_cnt);

		freed = ubifs_destroy_tnc_subtree(c, c->zroot.znode);

		ubifs_assert(c, freed == n);

		atomic_long_sub(n, &ubifs_clean_zn_cnt);

	}

	ubifs_destroy_tnc_tree(c);

	kfree(c->gap_lebs);

	kfree(c->ilebs);

	destroy_old_idx(c);

fs/ubifs/tnc_misc.c

+22 −0
Original line number Diff line number Diff line
@@ -250,6 +250,28 @@ long ubifs_destroy_tnc_subtree(const struct ubifs_info *c, 
	}

}



/**

 * ubifs_destroy_tnc_tree - destroy all znodes connected to the TNC tree.

 * @c: UBIFS file-system description object

 *

 * This function destroys the whole TNC tree and updates clean global znode

 * count.

 */

void ubifs_destroy_tnc_tree(struct ubifs_info *c)

{

	long n, freed;



	if (!c->zroot.znode)

		return;



	n = atomic_long_read(&c->clean_zn_cnt);

	freed = ubifs_destroy_tnc_subtree(c, c->zroot.znode);

	ubifs_assert(c, freed == n);

	atomic_long_sub(n, &ubifs_clean_zn_cnt);



	c->zroot.znode = NULL;

}



/**

 * read_znode - read an indexing node from flash and fill znode.

 * @c: UBIFS file-system description object

fs/ubifs/ubifs.h

+1 −0
Original line number Diff line number Diff line
@@ -1903,6 +1903,7 @@ struct ubifs_znode *ubifs_tnc_postorder_next(const struct ubifs_info *c, 
					     struct ubifs_znode *znode);

long ubifs_destroy_tnc_subtree(const struct ubifs_info *c,

			       struct ubifs_znode *zr);

void ubifs_destroy_tnc_tree(struct ubifs_info *c);

struct ubifs_znode *ubifs_load_znode(struct ubifs_info *c,

				     struct ubifs_zbranch *zbr,

				     struct ubifs_znode *parent, int iip);