linux-kernel - [PATCH -next] afs: Fix the memory leak in afs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 23 Jun 2020 19:15:28 +0800
From:   Chen Tao <chentao107@...wei.com>
To:     <dhowells@...hat.com>
CC:     <linux-afs@...ts.infradead.org>, <linux-kernel@...r.kernel.org>,
        <chentao107@...wei.com>
Subject: [PATCH -next] afs: Fix the memory leak in afs_mkdir

Fix the memory leak in afs_mkdir not freeing scb
in error path.

Fixes: a58823ac45896 ("afs: Fix application of status and callback to be under same lock")
Signed-off-by: Chen Tao <chentao107@...wei.com>
---
 fs/afs/dir.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index d1e1caa23c8b..ab5472ad1da8 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -1599,17 +1599,17 @@ static int afs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
 	if (dentry->d_name.len >= AFSNAMEMAX)
 		goto error;
 
-	key = afs_request_key(dvnode->volume->cell);
-	if (IS_ERR(key)) {
-		ret = PTR_ERR(key);
-		goto error;
-	}
-
 	ret = -ENOMEM;
 	scb = kcalloc(2, sizeof(struct afs_status_cb), GFP_KERNEL);
 	if (!scb)
 		goto error_scb;
 
+	key = afs_request_key(dvnode->volume->cell);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error_scb;
+	}
+
 	ret = -ERESTARTSYS;
 	if (afs_begin_vnode_operation(&fc, dvnode, key, true)) {
 		data_version = dvnode->status.data_version + 1;
@@ -1645,10 +1645,10 @@ static int afs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
 	_leave(" = 0");
 	return 0;
 
-error_scb:
-	kfree(scb);
 error_key:
 	key_put(key);
+error_scb:
+	kfree(scb);
 error:
 	d_drop(dentry);
 	_leave(" = %d", ret);
-- 
2.22.0