gfs2: Get rid of potential double-freeing in gfs2_create_inode

In gfs2_create_inode, after setting and releasing the acl / default_acl, the
acl / default_acl pointers are not set to NULL as they should be.  In that
state, when the function reaches label fail_free_acls, gfs2_create_inode will
try to release the same acls again.

Fix that by setting the pointers to NULL after releasing the acls.  Slightly
simplify the logic.  Also, posix_acl_release checks for NULL already, so
there is no need to duplicate those checks here.

Fixes: e01580bf9e4d ("gfs2: use generic posix ACL infrastructure")
Reported-by: Pan Bian <bianpan2016@163.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Bob Peterson <rpeterso@redhat.com>

diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 648f0ca1ad57e7893631d8c51f771aa47194fc7c..998051c4aea782717e93255f2a442cfb1693c0d2 100644 (file)
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -744,17 +744,19 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
                               the gfs2 structures. */
        if (default_acl) {
                error = __gfs2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
+               if (error)
+                       goto fail_gunlock3;
                posix_acl_release(default_acl);
+               default_acl = NULL;
        }
        if (acl) {
-               if (!error)
-                       error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
+               error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
+               if (error)
+                       goto fail_gunlock3;
                posix_acl_release(acl);
+               acl = NULL;
        }
 
-       if (error)
-               goto fail_gunlock3;
-
        error = security_inode_init_security(&ip->i_inode, &dip->i_inode, name,
                                             &gfs2_initxattrs, NULL);
        if (error)
@@ -789,10 +791,8 @@ fail_free_inode:
        }
        gfs2_rsqa_delete(ip, NULL);
 fail_free_acls:
-       if (default_acl)
-               posix_acl_release(default_acl);
-       if (acl)
-               posix_acl_release(acl);
+       posix_acl_release(default_acl);
+       posix_acl_release(acl);
 fail_gunlock:
        gfs2_dir_no_add(&da);
        gfs2_glock_dq_uninit(ghs);