[PATCH] fs/locks.c: Fix lease_init

It is insane to be giving lease_init() the task of freeing the lock it is
supposed to initialise, given that the lock is not guaranteed to be
allocated on the stack. This causes lockups in fcntl_setlease().
Problem diagnosed by Daniel Hokka Zakrisson <daniel@hozac.com>

Also fix a slab leak in __setlease() due to an uninitialised return value.
Problem diagnosed by Björn Steinbrink.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Tested-by: Daniel Hokka Zakrisson <daniel@hozac.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/fs/locks.c b/fs/locks.c
index efad798824dc19913b7aace09dbee47b8c6ca6a7..6f99c0a6f83629fbaa3eaaaf853fb6b7b9a9cfcc 100644 (file)
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -446,15 +446,14 @@ static struct lock_manager_operations lease_manager_ops = {
  */
 static int lease_init(struct file *filp, int type, struct file_lock *fl)
  {
+       if (assign_type(fl, type) != 0)
+               return -EINVAL;
+
        fl->fl_owner = current->files;
        fl->fl_pid = current->tgid;
 
        fl->fl_file = filp;
        fl->fl_flags = FL_LEASE;
-       if (assign_type(fl, type) != 0) {
-               locks_free_lock(fl);
-               return -EINVAL;
-       }
        fl->fl_start = 0;
        fl->fl_end = OFFSET_MAX;
        fl->fl_ops = NULL;
@@ -466,16 +465,19 @@ static int lease_init(struct file *filp, int type, struct file_lock *fl)
 static int lease_alloc(struct file *filp, int type, struct file_lock **flp)
 {
        struct file_lock *fl = locks_alloc_lock();
-       int error;
+       int error = -ENOMEM;
 
        if (fl == NULL)
-               return -ENOMEM;
+               goto out;
 
        error = lease_init(filp, type, fl);
-       if (error)
-               return error;
+       if (error) {
+               locks_free_lock(fl);
+               fl = NULL;
+       }
+out:
        *flp = fl;
-       return 0;
+       return error;
 }
 
 /* Check if two locks overlap each other.
@@ -1372,6 +1374,7 @@ static int __setlease(struct file *filp, long arg, struct file_lock **flp)
                goto out;
 
        if (my_before != NULL) {
+               *flp = *my_before;
                error = lease->fl_lmops->fl_change(my_before, arg);
                goto out;
        }