dlm: memory leaks on error path in dlm_user_request()
According to comment in dlm_user_request() ua should be freed
in dlm_free_lkb() after successful attach to lkb.
However ua is attached to lkb not in set_lock_args() but later,
inside request_lock().
Fixes 597d0cae0f
("[DLM] dlm: user locks")
Cc: stable@kernel.org # 2.6.19
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: David Teigland <teigland@redhat.com>
This commit is contained in:
parent
c0174726c3
commit
d47b41acee
|
@ -5795,20 +5795,20 @@ int dlm_user_request(struct dlm_ls *ls, struct dlm_user_args *ua,
|
|||
goto out;
|
||||
}
|
||||
}
|
||||
|
||||
/* After ua is attached to lkb it will be freed by dlm_free_lkb().
|
||||
When DLM_IFL_USER is set, the dlm knows that this is a userspace
|
||||
lock and that lkb_astparam is the dlm_user_args structure. */
|
||||
|
||||
error = set_lock_args(mode, &ua->lksb, flags, namelen, timeout_cs,
|
||||
fake_astfn, ua, fake_bastfn, &args);
|
||||
lkb->lkb_flags |= DLM_IFL_USER;
|
||||
|
||||
if (error) {
|
||||
kfree(ua->lksb.sb_lvbptr);
|
||||
ua->lksb.sb_lvbptr = NULL;
|
||||
kfree(ua);
|
||||
__put_lkb(ls, lkb);
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* After ua is attached to lkb it will be freed by dlm_free_lkb().
|
||||
When DLM_IFL_USER is set, the dlm knows that this is a userspace
|
||||
lock and that lkb_astparam is the dlm_user_args structure. */
|
||||
lkb->lkb_flags |= DLM_IFL_USER;
|
||||
error = request_lock(ls, lkb, name, namelen, &args);
|
||||
|
||||
switch (error) {
|
||||
|
|
Loading…
Reference in New Issue