[PATCH] ufs: free cylinder group structures on late mount failure

[Joseph Qi <joseph.qi@linux.alibaba.com>]

ufs_fill_super() reads the cylinder group structures before it creates
the root dentry, so that a failure there no longer publishes a
superblock whose s_fs_info has already been freed.  The two failures
that remain after the read, a failed ufs_iget() and a failed
d_make_root(), still jump to the label that only frees the in-core
superblock information.

Everything ufs_read_cylinder_structures() allocated is released by
ufs_put_super_internal(), which runs from ufs_put_super(), and
generic_shutdown_super() calls that only inside its if (sb->s_root)
block.  With s_root left NULL, the s_cssize allocation behind s_csp, the
s_ncg buffer heads behind s_ucg[] and the UFS_MAX_GROUP_LOADED s_ucpi[]
entries are leaked, once per mount attempt.

Neither failure needs an I/O error to happen: ufs_iget() rejects a root
inode number that falls outside the s_ncg * s_ipg range the image
claims, and s_ipg is not validated.

Give those two paths their own label, and move the unwind that
ufs_read_cylinder_structures() already performs on its own failure into
a helper that both call.  The helper also clears the pointers it
releases.

Fixes: 55a4c98abb96 ("ufs: create the root dentry after loading cylinder metadata")
Cc: stable@vger.kernel.org
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
---
 fs/ufs/super.c | 42 +++++++++++++++++++++++++++++++-----------
 1 file changed, 31 insertions(+), 11 deletions(-)

diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 3569ac92b065b..50adfef5f2aa9 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -448,6 +448,32 @@ static void ufs_setup_cstotal(struct super_block *sb)
 	UFSD("EXIT\n");
 }
 
+/*
+ * Release everything ufs_read_cylinder_structures() allocated.  Besides its
+ * own error path this is needed when a mount fails after the cylinder groups
+ * have been read: s_root is still NULL then, so generic_shutdown_super() never
+ * calls put_super and ufs_put_super_internal() does not run.
+ */
+static void ufs_free_cylinder_structures(struct super_block *sb)
+{
+	struct ufs_sb_info *sbi = UFS_SB(sb);
+	struct ufs_sb_private_info *uspi = sbi->s_uspi;
+	unsigned int i;
+
+	if (sbi->s_ucg) {
+		for (i = 0; i < uspi->s_ncg; i++)
+			brelse(sbi->s_ucg[i]);
+		kfree(sbi->s_ucg);
+		sbi->s_ucg = NULL;
+		for (i = 0; i < UFS_MAX_GROUP_LOADED; i++) {
+			kfree(sbi->s_ucpi[i]);
+			sbi->s_ucpi[i] = NULL;
+		}
+	}
+	kfree(sbi->s_csp);
+	sbi->s_csp = NULL;
+}
+
 /*
  * Read on-disk structures associated with cylinder groups
  */
@@ -511,15 +537,7 @@ static int ufs_read_cylinder_structures(struct super_block *sb)
 	return 1;
 
 failed:
-	kfree (base);
-	if (sbi->s_ucg) {
-		for (i = 0; i < uspi->s_ncg; i++)
-			if (sbi->s_ucg[i])
-				brelse (sbi->s_ucg[i]);
-		kfree (sbi->s_ucg);
-		for (i = 0; i < UFS_MAX_GROUP_LOADED; i++)
-			kfree (sbi->s_ucpi[i]);
-	}
+	ufs_free_cylinder_structures(sb);
 	UFSD("EXIT (FAILED)\n");
 	return 0;
 }
@@ -1211,17 +1229,19 @@ static int ufs_fill_super(struct super_block *sb, struct fs_context *fc)
 	inode = ufs_iget(sb, UFS_ROOTINO);
 	if (IS_ERR(inode)) {
 		ret = PTR_ERR(inode);
-		goto failed;
+		goto failed_cg;
 	}
 	sb->s_root = d_make_root(inode);
 	if (!sb->s_root) {
 		ret = -ENOMEM;
-		goto failed;
+		goto failed_cg;
 	}
 
 	UFSD("EXIT\n");
 	return 0;
 
+failed_cg:
+	ufs_free_cylinder_structures(sb);
 failed:
 	if (ubh)
 		ubh_brelse_uspi (uspi);
-- 
2.39.3