lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 20 Aug 2020 11:18:08 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-kernel@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org, Johannes Thumshirn <johannes.thumshirn@....com>, Filipe Manana <fdmanana@...e.com>, David Sterba <dsterba@...e.com> Subject: [PATCH 5.8 037/232] btrfs: fix memory leaks after failure to lookup checksums during inode logging From: Filipe Manana <fdmanana@...e.com> commit 4f26433e9b3eb7a55ed70d8f882ae9cd48ba448b upstream. While logging an inode, at copy_items(), if we fail to lookup the checksums for an extent we release the destination path, free the ins_data array and then return immediately. However a previous iteration of the for loop may have added checksums to the ordered_sums list, in which case we leak the memory used by them. So fix this by making sure we iterate the ordered_sums list and free all its checksums before returning. Fixes: 3650860b90cc2a ("Btrfs: remove almost all of the BUG()'s from tree-log.c") CC: stable@...r.kernel.org # 4.4+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn@....com> Signed-off-by: Filipe Manana <fdmanana@...e.com> Reviewed-by: David Sterba <dsterba@...e.com> Signed-off-by: David Sterba <dsterba@...e.com> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> --- fs/btrfs/tree-log.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -4027,11 +4027,8 @@ static noinline int copy_items(struct bt fs_info->csum_root, ds + cs, ds + cs + cl - 1, &ordered_sums, 0); - if (ret) { - btrfs_release_path(dst_path); - kfree(ins_data); - return ret; - } + if (ret) + break; } } } @@ -4044,7 +4041,6 @@ static noinline int copy_items(struct bt * we have to do this after the loop above to avoid changing the * log tree while trying to change the log tree. */ - ret = 0; while (!list_empty(&ordered_sums)) { struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next, struct btrfs_ordered_sum,
Powered by blists - more mailing lists