configfs: fix config_item refcnt leak in configfs_rmdir()
authorXiyu Yang <xiyuyang19@fudan.edu.cn>
Sat, 25 Apr 2020 12:52:26 +0000 (20:52 +0800)
committerChristoph Hellwig <hch@lst.de>
Mon, 27 Apr 2020 06:17:10 +0000 (08:17 +0200)
commit8aebfffacfa379ba400da573a5bf9e49634e38cb
tree81791bfd6bc7b1cb22edd31de2e6ea7ea2234506
parent6a8b55ed4056ea5559ebe4f6a4b247f627870d4c
configfs: fix config_item refcnt leak in configfs_rmdir()

configfs_rmdir() invokes configfs_get_config_item(), which returns a
reference of the specified config_item object to "parent_item" with
increased refcnt.

When configfs_rmdir() returns, local variable "parent_item" becomes
invalid, so the refcount should be decreased to keep refcount balanced.

The reference counting issue happens in one exception handling path of
configfs_rmdir(). When down_write_killable() fails, the function forgets
to decrease the refcnt increased by configfs_get_config_item(), causing
a refcnt leak.

Fix this issue by calling config_item_put() when down_write_killable()
fails.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
fs/configfs/dir.c