diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2008-08-01 04:29:18 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2008-08-01 11:25:25 -0400 |
| commit | 77e69dac3cefacee939cb107ae9cd520a62338e0 (patch) | |
| tree | 02ddee5ac85ceb632eab2aff994ffbd3233e51eb /fs/reiserfs | |
| parent | 1b7e190b4764ea3ca1080404dd593eae5230d2b3 (diff) | |
| download | kernel_samsung_aries-77e69dac3cefacee939cb107ae9cd520a62338e0.zip kernel_samsung_aries-77e69dac3cefacee939cb107ae9cd520a62338e0.tar.gz kernel_samsung_aries-77e69dac3cefacee939cb107ae9cd520a62338e0.tar.bz2 | |
[PATCH] fix races and leaks in vfs_quota_on() users
* new helper: vfs_quota_on_path(); equivalent of vfs_quota_on() sans the
pathname resolution.
* callers of vfs_quota_on() that do their own pathname resolution and
checks based on it are switched to vfs_quota_on_path(); that way we
avoid the races.
* reiserfs leaked dentry/vfsmount references on several failure exits.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/reiserfs')
| -rw-r--r-- | fs/reiserfs/super.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c index 879e54d..282a135 100644 --- a/fs/reiserfs/super.c +++ b/fs/reiserfs/super.c @@ -2076,8 +2076,8 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id, return err; /* Quotafile not on the same filesystem? */ if (nd.path.mnt->mnt_sb != sb) { - path_put(&nd.path); - return -EXDEV; + err = -EXDEV; + goto out; } inode = nd.path.dentry->d_inode; /* We must not pack tails for quota files on reiserfs for quota IO to work */ @@ -2087,8 +2087,8 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id, reiserfs_warning(sb, "reiserfs: Unpacking tail of quota file failed" " (%d). Cannot turn on quotas.", err); - path_put(&nd.path); - return -EINVAL; + err = -EINVAL; + goto out; } mark_inode_dirty(inode); } @@ -2109,13 +2109,15 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id, /* Just start temporary transaction and finish it */ err = journal_begin(&th, sb, 1); if (err) - return err; + goto out; err = journal_end_sync(&th, sb, 1); if (err) - return err; + goto out; } + err = vfs_quota_on_path(sb, type, format_id, &nd.path); +out: path_put(&nd.path); - return vfs_quota_on(sb, type, format_id, path, 0); + return err; } /* Read data from quotafile - avoid pagecache and such because we cannot afford |