Re: [PATCH] fs/iomap: fix memory leak on error condition

[Dave Chinner]

On Wed, Feb 21, 2018 at 08:41:28PM +0000, Garry McNulty wrote:
> If the call to is_sync_kiocb() fails an error is returned without
> freeing dio. Set the return code and jump to out_free_dio.
> 
> Detected by CoverityScan, CID 1429424 ("Resource leak")

Coverity is wrong.

> Signed-off-by: Garry McNulty <garrmcnu@xxxxxxxxx>
> ---
>  fs/iomap.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/iomap.c b/fs/iomap.c
> index afd163586aa0..65c5db38c15a 100644
> --- a/fs/iomap.c
> +++ b/fs/iomap.c
> @@ -1063,8 +1063,10 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
>  		iomap_dio_set_error(dio, ret);
>  
>  	if (!atomic_dec_and_test(&dio->ref)) {
> -		if (!is_sync_kiocb(iocb))
> -			return -EIOCBQUEUED;
> +		if (!is_sync_kiocb(iocb)) {
> +			ret = -EIOCBQUEUED;
> +			goto out_free_dio;
> +		}

This is where we return after AIO submission. The struct dio has
already been attached to the bio we have submitted, and will be
freed on IO completion.  We are simply not waiting for IO completion
here, instead leaving it to the completion code to free the struct
dio and pass the completion status to the AIO code appropriately.

Cheers,

Dave.
-- 
Dave Chinner
david@xxxxxxxxxxxxx