[PATCH] procfs: Fix error handling of proc_register()

[Debabrata Banerjee]

I don't see why this should print warnings at all instead of properly
unrolling allocations and returning an appropriate error. It's actually
leaking resources currently.

to: Alexander Viro <***@zeniv.linux.org.uk>
to: linux-***@vger.kernel.org
cc: linux-***@vger.kernel.org
Signed-off-by: Debabrata Banerjee <***@akamai.com>
---
fs/proc/generic.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 317b726..89b20cc 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -304,6 +304,7 @@ static int proc_register(struct proc_dir_entry * dir, struct proc_dir_entry * dp
dp->proc_iops = &proc_file_inode_operations;
} else {
WARN_ON(1);
+ proc_free_inum(dp->low_ino);
return -EINVAL;
}

@@ -311,9 +312,13 @@ static int proc_register(struct proc_dir_entry * dir, struct proc_dir_entry * dp

for (tmp = dir->subdir; tmp; tmp = tmp->next)
if (strcmp(tmp->name, dp->name) == 0) {
- WARN(1, "proc_dir_entry '%s/%s' already registered\n",
- dir->name, dp->name);
- break;
+ spin_unlock(&proc_subdir_lock);
+
+ if (S_ISDIR(dp->mode))
+ dir->nlink--;
+
+ proc_free_inum(dp->low_ino);
+ return -EEXIST;
}

dp->next = dir->subdir;

[Andrew Morton]

Post by Debabrata Banerjee
I don't see why this should print warnings at all instead of properly
unrolling allocations and returning an appropriate error. It's actually
leaking resources currently.

I think the warnings are useful - a duplicate name in /proc is a
significant kernel bug and we'll want to know precisely what caused it
and get it fixed up quickly. So let's keep that bit.

Post by Debabrata Banerjee
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -304,6 +304,7 @@ static int proc_register(struct proc_dir_entry * dir, struct proc_dir_entry * dp
dp->proc_iops = &proc_file_inode_operations;
} else {
WARN_ON(1);
+ proc_free_inum(dp->low_ino);
return -EINVAL;
}
@@ -311,9 +312,13 @@ static int proc_register(struct proc_dir_entry * dir, struct proc_dir_entry * dp
for (tmp = dir->subdir; tmp; tmp = tmp->next)
if (strcmp(tmp->name, dp->name) == 0) {
- WARN(1, "proc_dir_entry '%s/%s' already registered\n",
- dir->name, dp->name);
- break;
+ spin_unlock(&proc_subdir_lock);
+
+ if (S_ISDIR(dp->mode))
+ dir->nlink--;
+
+ proc_free_inum(dp->low_ino);
+ return -EEXIST;
}

Your patch conflicts somewhat with Nicolas's "fs/proc: use a rb tree for
the directory entries". Here's what I ended up with:



From: Debabrata Banerjee <***@akamai.com>
Subject: procfs: fix error handling of proc_register()

proc_register() error paths are leaking inodes and directory refcounts.

Signed-off-by: Debabrata Banerjee <***@akamai.com>
Cc: Alexander Viro <***@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <***@linux-foundation.org>
---

fs/proc/generic.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff -puN fs/proc/generic.c~procfs-fix-error-handling-of-proc_register fs/proc/generic.c
--- a/fs/proc/generic.c~procfs-fix-error-handling-of-proc_register
+++ a/fs/proc/generic.c
@@ -369,14 +369,21 @@ static int proc_register(struct proc_dir
dp->proc_iops = &proc_file_inode_operations;
} else {
WARN_ON(1);
+ proc_free_inum(dp->low_ino);
return -EINVAL;
}

spin_lock(&proc_subdir_lock);
dp->parent = dir;
- if (pde_subdir_insert(dir, dp) == false)
+ if (pde_subdir_insert(dir, dp) == false) {
WARN(1, "proc_dir_entry '%s/%s' already registered\n",
dir->name, dp->name);
+ spin_unlock(&proc_subdir_lock);
+ if (S_ISDIR(dp->mode))
+ dir->nlink--;
+ proc_free_inum(dp->low_ino);
+ return -EEXIST;
+ }
spin_unlock(&proc_subdir_lock);

return 0;
_


--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

[Nicolas Dichtel]

Post by Andrew Morton

I don't see why this should print warnings at all instead of proper=

ly

Post by Andrew Morton

unrolling allocations and returning an appropriate error. It's actu=

ally

Post by Andrew Morton

leaking resources currently.

I think the warnings are useful - a duplicate name in /proc is a
significant kernel bug and we'll want to know precisely what caused i=

t

Post by Andrew Morton
and get it fixed up quickly. So let's keep that bit.

--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -304,6 +304,7 @@ static int proc_register(struct proc_dir_entry *=

dir, struct proc_dir_entry * dp

Post by Andrew Morton

dp->proc_iops =3D &proc_file_inode_operations;
} else {
WARN_ON(1);
+ proc_free_inum(dp->low_ino);
return -EINVAL;
}
@@ -311,9 +312,13 @@ static int proc_register(struct proc_dir_entry =

* dir, struct proc_dir_entry * dp

Post by Andrew Morton

for (tmp =3D dir->subdir; tmp; tmp =3D tmp->next)
if (strcmp(tmp->name, dp->name) =3D=3D 0) {
- WARN(1, "proc_dir_entry '%s/%s' already registered\n",
- dir->name, dp->name);
- break;
+ spin_unlock(&proc_subdir_lock);
+
+ if (S_ISDIR(dp->mode))
+ dir->nlink--;
+
+ proc_free_inum(dp->low_ino);
+ return -EEXIST;
}

Your patch conflicts somewhat with Nicolas's "fs/proc: use a rb tree =

for

Post by Andrew Morton
Subject: procfs: fix error handling of proc_register()
proc_register() error paths are leaking inodes and directory refcount=

s.
Acked-by: Nicolas Dichtel <***@6wind.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel=
" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html