From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756010AbcLNNoT (ORCPT ); Wed, 14 Dec 2016 08:44:19 -0500 Received: from 6.mo179.mail-out.ovh.net ([46.105.56.76]:49491 "EHLO 6.mo179.mail-out.ovh.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753463AbcLNNoR (ORCPT ); Wed, 14 Dec 2016 08:44:17 -0500 X-Greylist: delayed 12599 seconds by postgrey-1.27 at vger.kernel.org; Wed, 14 Dec 2016 08:44:16 EST Date: Wed, 14 Dec 2016 09:57:48 +0100 From: Greg Kurz To: Cong Wang Cc: linux-kernel@vger.kernel.org, Latchesar Ionkov , Ron Minnich , jack@suse.cz, Eric Van Hensbergen , salyzyn@android.com, v9fs-developer@lists.sourceforge.net Subject: Re: [V9fs-developer] [Patch] 9p: fix a potential acl leak Message-ID: <20161214095748.53cd9d9c@bahia.lan> In-Reply-To: <1481654014-5563-1-git-send-email-xiyou.wangcong@gmail.com> References: <1481654014-5563-1-git-send-email-xiyou.wangcong@gmail.com> X-Mailer: Claws Mail 3.14.0 (GTK+ 2.24.31; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Ovh-Tracer-Id: 690458121663912215 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeelfedrieehgdeigecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfqggfjpdevjffgvefmvefgnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 13 Dec 2016 10:33:34 -0800 Cong Wang wrote: > posix_acl_update_mode() could possibly clear 'acl', if so > we leak the memory pointed by 'acl'. Save this pointer > before calling posix_acl_update_mode() and release the memory > if 'acl' really gets cleared. > > Reported-by: Mark Salyzyn > Reviewed-by: Jan Kara > Cc: Eric Van Hensbergen > Cc: Ron Minnich > Cc: Latchesar Ionkov > Signed-off-by: Cong Wang > --- Reviewed-by: Greg Kurz > fs/9p/acl.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/fs/9p/acl.c b/fs/9p/acl.c > index b3c2cc7..082d227 100644 > --- a/fs/9p/acl.c > +++ b/fs/9p/acl.c > @@ -277,6 +277,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler, > case ACL_TYPE_ACCESS: > if (acl) { > struct iattr iattr; > + struct posix_acl *old_acl = acl; > > retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl); > if (retval) > @@ -287,6 +288,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler, > * by the mode bits. So don't > * update ACL. > */ > + posix_acl_release(old_acl); > value = NULL; > size = 0; > }