Commit dfb1922a authored by Andreas Gruenbacher's avatar Andreas Gruenbacher Committed by Greg Kroah-Hartman

gfs2: Get rid of potential double-freeing in gfs2_create_inode

commit 6ff9b09e upstream.

In gfs2_create_inode, after setting and releasing the acl / default_acl, the
acl / default_acl pointers are not set to NULL as they should be.  In that
state, when the function reaches label fail_free_acls, gfs2_create_inode will
try to release the same acls again.

Fix that by setting the pointers to NULL after releasing the acls.  Slightly
simplify the logic.  Also, posix_acl_release checks for NULL already, so
there is no need to duplicate those checks here.

Fixes: e01580bf ("gfs2: use generic posix ACL infrastructure")
Reported-by: default avatarPan Bian <>
Cc: Christoph Hellwig <>
Cc: # v4.9+
Signed-off-by: default avatarAndreas Gruenbacher <>
Signed-off-by: default avatarBob Peterson <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent d6d47998
......@@ -744,17 +744,19 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
the gfs2 structures. */
if (default_acl) {
error = __gfs2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
if (error)
goto fail_gunlock3;
default_acl = NULL;
if (acl) {
if (!error)
error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
if (error)
goto fail_gunlock3;
acl = NULL;
if (error)
goto fail_gunlock3;
error = security_inode_init_security(&ip->i_inode, &dip->i_inode, name,
&gfs2_initxattrs, NULL);
if (error)
......@@ -789,10 +791,8 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
gfs2_rsqa_delete(ip, NULL);
if (default_acl)
if (acl)
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment