Hi,
there seems to be a node leak in NTFS in two places: ntfs_ntget(ip) is
called, but the two functions return without calling ntfs_ntput(ip).

I would like some okayz before committing; I can't test it.

Regards,
Maxime

Index: ntfs_subr.c
===================================================================
RCS file: /cvsroot/src/sys/fs/ntfs/ntfs_subr.c,v
retrieving revision 1.55
diff -u -r1.55 ntfs_subr.c
--- ntfs_subr.c 28 Dec 2014 14:42:56 -0000      1.55
+++ ntfs_subr.c 29 Dec 2014 16:17:04 -0000
@@ -759,9 +759,9 @@
 {
        struct fnode   *fp = VTOF(vp);
        struct ntnode  *ip = FTONT(fp);
-       struct ntvattr *vap;    /* Root attribute */
+       struct ntvattr *vap = NULL;     /* Root attribute */
        cn_t            cn = 0; /* VCN in current attribute */
-       void *        rdbuf;    /* Buffer to read directory's blocks  */
+       void *        rdbuf = NULL;     /* Buffer to read directory's blocks  */
        u_int32_t       blsize;
        u_int32_t       rdsize; /* Length of data to read from current block */
        struct attr_indexentry *iep;
@@ -779,8 +779,10 @@
                return (error);
 
        error = ntfs_ntvattrget(ntmp, ip, NTFS_A_INDXROOT, "$I30", 0, &vap);
-       if (error || (vap->va_flag & NTFS_AF_INRUN))
-               return (ENOTDIR);
+       if (error || (vap->va_flag & NTFS_AF_INRUN)) {
+               error = ENOTDIR;
+               goto fail;
+       }
 
        /*
         * Divide file name into: foofilefoofilefoofile[:attrspec]
@@ -966,9 +968,11 @@
                        free(tctx, M_TEMP);
                }
        }
-       ntfs_ntvattrrele(vap);
+       if (vap)
+               ntfs_ntvattrrele(vap);
+       if (rdbuf)
+               free(rdbuf, M_TEMP);
        ntfs_ntput(ip);
-       free(rdbuf, M_TEMP);
        return (error);
 }
 
@@ -1029,8 +1033,10 @@
                return (error);
 
        error = ntfs_ntvattrget(ntmp, ip, NTFS_A_INDXROOT, "$I30", 0, &vap);
-       if (error)
-               return (ENOTDIR);
+       if (error) {
+               error = ENOTDIR;
+               goto fail;
+       }
 
        if (fp->f_dirblbuf == NULL) {
                fp->f_dirblsz = vap->va_a_iroot->ir_size;

Reply via email to