linux-ext4 - [PATCH] ext4: Fix invalid free of cache->name after ext4_mb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 24 Jan 2011 13:42:27 +0000
From:	Chris Wilson <chris@...is-wilson.co.uk>
To:	linux-ext4@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org,
	Chris Wilson <chris@...is-wilson.co.uk>,
	"Theodore Ts'o" <tytso@....edu>,
	Andreas Dilger <adilger.kernel@...ger.ca>
Subject: [PATCH] ext4: Fix invalid free of cache->name after ext4_mb_init() error

The name allocated for the kmem_cache was being freed in the error path even
if that name was still assigned to the newly created cache.

Cc: "Theodore Ts'o" <tytso@....edu>
Cc: Andreas Dilger <adilger.kernel@...ger.ca>
Signed-off-by: Chris Wilson <chris@...is-wilson.co.uk>
---
 fs/ext4/mballoc.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 851f49b..69b90fe 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2423,7 +2423,6 @@ int ext4_mb_init(struct super_block *sb, int needs_recovery)
 	int ret;
 	int cache_index;
 	struct kmem_cache *cachep;
-	char *namep = NULL;
 
 	i = (sb->s_blocksize_bits + 2) * sizeof(*sbi->s_mb_offsets);
 
@@ -2443,7 +2442,7 @@ int ext4_mb_init(struct super_block *sb, int needs_recovery)
 	cache_index = sb->s_blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE;
 	cachep = ext4_groupinfo_caches[cache_index];
 	if (!cachep) {
-		char name[32];
+		char name[32], *namep;
 		int len = offsetof(struct ext4_group_info,
 					bb_counters[sb->s_blocksize_bits + 2]);
 
@@ -2459,6 +2458,7 @@ int ext4_mb_init(struct super_block *sb, int needs_recovery)
 		cachep = kmem_cache_create(namep, len, 0,
 					     SLAB_RECLAIM_ACCOUNT, NULL);
 		if (!cachep) {
+			kfree(namep);
 			ret = -ENOMEM;
 			goto out;
 		}
@@ -2520,7 +2520,6 @@ out:
 	if (ret) {
 		kfree(sbi->s_mb_offsets);
 		kfree(sbi->s_mb_maxs);
-		kfree(namep);
 	}
 	return ret;
 }
-- 
1.7.2.3

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html