[PATCH 0/3] Use dput() after d_find_alias().

[PATCH 0/3] Use dput() after d_find_alias().

[Cyril Roelandt]

Hello,

A call to d_find_alias() needs a corresponding call to dput() in order to avoid
resource leaks.

The first patch is a Coccinelle scripts that looks for missing calls to dput().
The other two patches add calls to dput() where needed.

WBR,
Cyril Roelandt.

[PATCH 1/3] Coccinelle: Add api/d_find_alias.cocci.

[Cyril Roelandt]

Ensure that calls to d_find_alias() have a corresponding dput().

Signed-off-by: Cyril Roelandt <tipecaml@gmail.com>
---
 scripts/coccinelle/api/d_find_alias.cocci |   80 +++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 scripts/coccinelle/api/d_find_alias.cocci

diff --git a/scripts/coccinelle/api/d_find_alias.cocci b/scripts/coccinelle/api/d_find_alias.cocci
new file mode 100644
index 0000000..639eec7
--- /dev/null
+++ b/scripts/coccinelle/api/d_find_alias.cocci
@@ -0,0 +1,80 @@
+/// Make sure calls to d_find_alias() have a corresponding call to dput().
+//
+// Keywords: d_find_alias, dput
+//
+// Confidence: Moderate
+// URL: http://coccinelle.lip6.fr/
+// Options: -include_headers
+
+virtual context
+virtual org
+virtual patch
+virtual report
+
+@r exists@
+local idexpression struct dentry *dent;
+expression E, E1;
+statement S1, S2;
+position p1, p2;
+@@
+(
+	if (!(dent@p1 = d_find_alias(...))) S1
+|
+	dent@p1 = d_find_alias(...)
+)
+
+<...when != dput(dent)
+    when != if (...) { <+... dput(dent) ...+> }
+    when != true !dent || ...
+    when != dent = E
+    when != E = dent
+if (!dent || ...) S2
+...>
+(
+	return <+...dent...+>;
+|
+	return @p2 ...;
+|
+	dent@p2 = E1;
+|
+	E1 = dent;
+)
+
+@depends on context@
+local idexpression struct dentry *r.dent;
+position r.p1,r.p2;
+@@
+* dent@p1 = ...
+  ...
+(
+* return@p2 ...;
+|
+* dent@p2
+)
+
+
+@script:python depends on org@
+p1 << r.p1;
+p2 << r.p2;
+@@
+cocci.print_main("Missing call to dput()",p1)
+cocci.print_secs("",p2)
+
+@depends on patch@
+local idexpression struct dentry *r.dent;
+position r.p2;
+@@
+(
++ dput(dent);
+  return @p2 ...;
+|
++ dput(dent);
+  dent@p2 = ...;
+)
+
+@script:python depends on report@
+p1 << r.p1;
+p2 << r.p2;
+@@
+msg = "Missing call to dput() at line %s."
+coccilib.report.print_report(p1[0], msg % (p2[0].line))
-- 
1.7.10.4

[PATCH 2/3] iommu/tegra-smmu.c: fix dentry reference leak in smmu_debugfs_stats_show().

[Cyril Roelandt]

Call to d_find_alias() needs a corresponding dput().

Signed-off-by: Cyril Roelandt <tipecaml@gmail.com>
---
 drivers/iommu/tegra-smmu.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
index 4167863..4252d74 100644
--- a/drivers/iommu/tegra-smmu.c
+++ b/drivers/iommu/tegra-smmu.c
@@ -1052,6 +1052,7 @@ static int smmu_debugfs_stats_show(struct seq_file *s, void *v)
 			stats[i], val, offs);
 	}
 	seq_printf(s, "\n");
+	dput(dent);
 
 	return 0;
 }
-- 
1.7.10.4

Re: [PATCH 2/3] iommu/tegra-smmu.c: fix dentry reference leak in smmu_debugfs_stats_show().

[Hiroshi Doyu]

Cyril Roelandt <tipecaml@gmail.com> wrote @ Sun, 11 Nov 2012 21:49:30 +0100:

> Call to d_find_alias() needs a corresponding dput().
> 
> Signed-off-by: Cyril Roelandt <tipecaml@gmail.com>
> ---

Thanks. Looks ok for me. Acked-by Hiroshi Doyu <hdoyu@nvidia.com>

Re: [PATCH 2/3] iommu/tegra-smmu.c: fix dentry reference leak in smmu_debugfs_stats_show().

[Joerg Roedel]

On Sun, Nov 11, 2012 at 09:49:30PM +0100, Cyril Roelandt wrote:
> Call to d_find_alias() needs a corresponding dput().
> 
> Signed-off-by: Cyril Roelandt <tipecaml@gmail.com>

Applied to iommu/fixes, thanks.

[PATCH 3/3] ceph: fix dentry reference leak in ceph_encode_fh().

[Cyril Roelandt]

dput() was not called in the error path.

Signed-off-by: Cyril Roelandt <tipecaml@gmail.com>
---
 fs/ceph/export.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index 9349bb3..ca3ab3f 100644
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -56,13 +56,15 @@ static int ceph_encode_fh(struct inode *inode, u32 *rawfh, int *max_len,
 	struct ceph_nfs_confh *cfh = (void *)rawfh;
 	int connected_handle_length = sizeof(*cfh)/4;
 	int handle_length = sizeof(*fh)/4;
-	struct dentry *dentry = d_find_alias(inode);
+	struct dentry *dentry;
 	struct dentry *parent;
 
 	/* don't re-export snaps */
 	if (ceph_snap(inode) != CEPH_NOSNAP)
 		return -EINVAL;
 
+	dentry = d_find_alias(inode);
+
 	/* if we found an alias, generate a connectable fh */
 	if (*max_len >= connected_handle_length && dentry) {
 		dout("encode_fh %p connectable\n", dentry);
-- 
1.7.10.4

Re: [PATCH 3/3] ceph: fix dentry reference leak in ceph_encode_fh().

[Alex Elder]

On 11/11/2012 02:49 PM, Cyril Roelandt wrote:
> dput() was not called in the error path.
> 
> Signed-off-by: Cyril Roelandt <tipecaml@gmail.com>

This looks good, thanks a lot.  I'll apply it.

Reviewed-by: Alex Elder <elder@inktank.com>

> ---
>  fs/ceph/export.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ceph/export.c b/fs/ceph/export.c
> index 9349bb3..ca3ab3f 100644
> --- a/fs/ceph/export.c
> +++ b/fs/ceph/export.c
> @@ -56,13 +56,15 @@ static int ceph_encode_fh(struct inode *inode, u32 *rawfh, int *max_len,
>  	struct ceph_nfs_confh *cfh = (void *)rawfh;
>  	int connected_handle_length = sizeof(*cfh)/4;
>  	int handle_length = sizeof(*fh)/4;
> -	struct dentry *dentry = d_find_alias(inode);
> +	struct dentry *dentry;
>  	struct dentry *parent;
>  
>  	/* don't re-export snaps */
>  	if (ceph_snap(inode) != CEPH_NOSNAP)
>  		return -EINVAL;
>  
> +	dentry = d_find_alias(inode);
> +
>  	/* if we found an alias, generate a connectable fh */
>  	if (*max_len >= connected_handle_length && dentry) {
>  		dout("encode_fh %p connectable\n", dentry);
>