linux-kernel - Re: [PATCH 1/3] ubifs: Fix a memleak after dumping authentication mount options

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200930070956.GD11648@pengutronix.de>
Date:   Wed, 30 Sep 2020 09:09:56 +0200
From:   Sascha Hauer <s.hauer@...gutronix.de>
To:     Zhihao Cheng <chengzhihao1@...wei.com>
Cc:     richard@....at, yi.zhang@...wei.com, linux-mtd@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/3] ubifs: Fix a memleak after dumping authentication
 mount options

On Tue, Sep 29, 2020 at 08:45:29PM +0800, Zhihao Cheng wrote:
> Fix a memory leak after dumping authentication mount options in error
> handling branch.
> 
> Signed-off-by: Zhihao Cheng <chengzhihao1@...wei.com>
> Cc: <stable@...r.kernel.org>  # 4.20+
> Fixes: d8a22773a12c6d7 ("ubifs: Enable authentication support")

Reviewed-by: Sascha Hauer <s.hauer@...gutronix.de>

I wonder if patches like in this series should really go to stable. There's
always the risk of regressions, and there's not much to win in fixing
such low probability, low frequency memory holes.

Sascha

> ---
>  fs/ubifs/super.c | 16 ++++++++++++++--
>  1 file changed, 14 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
> index a2420c900275..6f85cd618766 100644
> --- a/fs/ubifs/super.c
> +++ b/fs/ubifs/super.c
> @@ -1141,6 +1141,18 @@ static int ubifs_parse_options(struct ubifs_info *c, char *options,
>  	return 0;
>  }
>  
> +/*
> + * ubifs_release_options - release mount parameters which have been dumped.
> + * @c: UBIFS file-system description object
> + */
> +static void ubifs_release_options(struct ubifs_info *c)
> +{
> +	kfree(c->auth_key_name);
> +	c->auth_key_name = NULL;
> +	kfree(c->auth_hash_name);
> +	c->auth_hash_name = NULL;
> +}
> +
>  /**
>   * destroy_journal - destroy journal data structures.
>   * @c: UBIFS file-system description object
> @@ -1650,8 +1662,7 @@ static void ubifs_umount(struct ubifs_info *c)
>  	ubifs_lpt_free(c, 0);
>  	ubifs_exit_authentication(c);
>  
> -	kfree(c->auth_key_name);
> -	kfree(c->auth_hash_name);
> +	ubifs_release_options(c);
>  	kfree(c->cbuf);
>  	kfree(c->rcvrd_mst_node);
>  	kfree(c->mst_node);
> @@ -2219,6 +2230,7 @@ static int ubifs_fill_super(struct super_block *sb, void *data, int silent)
>  out_unlock:
>  	mutex_unlock(&c->umount_mutex);
>  out_close:
> +	ubifs_release_options(c);
>  	ubi_close_volume(c->ubi);
>  out:
>  	return err;
> -- 
> 2.25.4
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |