Re: [PATCH] Btrfs: fix memory leak in btrfs_create_tree()

[Alex Lyakas <alex.btrfs@xxxxxxxxxxxxxxxxx>]

Hi Tsutomu Itoh,

On Thu, Mar 21, 2013 at 6:32 AM, Tsutomu Itoh <t-itoh@xxxxxxxxxxxxxx> wrote:
> We should free leaf and root before returning from the error
> handling code.
>
> Signed-off-by: Tsutomu Itoh <t-itoh@xxxxxxxxxxxxxx>
> ---
>  fs/btrfs/disk-io.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
> index 7d84651..b1b5baa 100644
> --- a/fs/btrfs/disk-io.c
> +++ b/fs/btrfs/disk-io.c
> @@ -1291,6 +1291,7 @@ struct btrfs_root *btrfs_create_tree(struct btrfs_trans_handle *trans,
>                                       0, objectid, NULL, 0, 0, 0);
>         if (IS_ERR(leaf)) {
>                 ret = PTR_ERR(leaf);
> +               leaf = NULL;
>                 goto fail;
>         }
>
> @@ -1334,11 +1335,16 @@ struct btrfs_root *btrfs_create_tree(struct btrfs_trans_handle *trans,
>
>         btrfs_tree_unlock(leaf);
>
> +       return root;
> +
>  fail:
> -       if (ret)
> -               return ERR_PTR(ret);
> +       if (leaf) {
> +               btrfs_tree_unlock(leaf);
> +               free_extent_buffer(leaf);
I believe this is not enough. Few lines above, another reference on
the root is taken by
root->commit_root = btrfs_root_node(root);

So I believe the proper fix would be:
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index d9698fd..260af79 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1354,10 +1354,10 @@ struct btrfs_root *btrfs_create_tree(struct
btrfs_trans_handle *trans,
        return root;

 fail:
-       if (leaf) {
+       if (leaf)
                btrfs_tree_unlock(leaf);
-               free_extent_buffer(leaf);
-       }
+       free_extent_buffer(root->node);
+       free_extent_buffer(root->commit_root);
        kfree(root);

        return ERR_PTR(ret);



Thanks,
Alex.



> +       }
> +       kfree(root);
>
> -       return root;
> +       return ERR_PTR(ret);
>  }
>
>  static struct btrfs_root *alloc_log_tree(struct btrfs_trans_handle *trans,
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html