mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-04 18:09:57 +00:00
Code Issues Releases Wiki Activity

ubifs: dirty_cow_znode: Fix memleak in error handling path

Browse source 
[ Upstream commit 122deabfe1 ]

Following process will cause a memleak for copied up znode:

dirty_cow_znode
  zn = copy_znode(c, znode);
  err = insert_old_idx(c, zbr->lnum, zbr->offs);
  if (unlikely(err))
     return ERR_PTR(err);   // No one refers to zn.

Fix it by adding copied znode back to tnc, then it will be freed
by ubifs_destroy_tnc_subtree() while closing tnc.

Fetch a reproducer in [Link].

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216705
Fixes: 1e51764a3c ("UBIFS: add new flash file system")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Zhihao Cheng 2022-11-18 17:02:36 +08:00 committed by Greg Kroah-Hartman
parent 0875edcad4
commit 510b80abe8
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
fs/ubifs/tnc.c
View file

@ -267,11 +267,18 @@ static struct ubifs_znode *dirty_cow_znode(struct ubifs_info *c,
if (zbr->len) {
err = insert_old_idx(c, zbr->lnum, zbr->offs);
if (unlikely(err))
return ERR_PTR(err);
/*
* Obsolete znodes will be freed by tnc_destroy_cnext()
* or free_obsolete_znodes(), copied up znodes should
* be added back to tnc and freed by
* ubifs_destroy_tnc_subtree().
*/
goto out;
err = add_idx_dirt(c, zbr->lnum, zbr->len);
} else
err = 0;
out:
zbr->znode = zn;
zbr->lnum = 0;
zbr->offs = 0;