linux-kernel - Re: [PATCH 3/5] erofs: use meta buffers for super operations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202112310650.TDDinvVT-lkp@intel.com>
Date:   Thu, 6 Jan 2022 18:08:48 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Gao Xiang <hsiangkao@...ux.alibaba.com>,
        linux-erofs@...ts.ozlabs.org, Chao Yu <yuchao0@...wei.com>,
        Chao Yu <chao@...nel.org>, Liu Bo <bo.liu@...ux.alibaba.com>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        LKML <linux-kernel@...r.kernel.org>,
        Gao Xiang <hsiangkao@...ux.alibaba.com>
Subject: Re: [PATCH 3/5] erofs: use meta buffers for super operations

Hi Gao,

url:    https://github.com/0day-ci/linux/commits/Gao-Xiang/erofs-get-rid-of-erofs_get_meta_page/20211229-121538
base:   https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git dev-test
config: x86_64-randconfig-m001-20211230 (https://download.01.org/0day-ci/archive/20211231/202112310650.TDDinvVT-lkp@intel.com/config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
fs/erofs/super.c:153 erofs_read_metadata() warn: possible memory leak of 'buffer'

vim +/buffer +153 fs/erofs/super.c

6477e408d41152 fs/erofs/super.c              Gao Xiang 2021-12-29  128  static void *erofs_read_metadata(struct super_block *sb, struct erofs_buf *buf,
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  129  				 erofs_off_t *offset, int *lengthp)
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  130  {
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  131  	u8 *buffer, *ptr;
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  132  	int len, i, cnt;
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  133  
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  134  	*offset = round_up(*offset, 4);
6477e408d41152 fs/erofs/super.c              Gao Xiang 2021-12-29  135  	ptr = erofs_read_metabuf(buf, sb, erofs_blknr(*offset), EROFS_KMAP);
6477e408d41152 fs/erofs/super.c              Gao Xiang 2021-12-29  136  	if (IS_ERR(ptr))
6477e408d41152 fs/erofs/super.c              Gao Xiang 2021-12-29  137  		return ptr;
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  138  
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  139  	len = le16_to_cpu(*(__le16 *)&ptr[erofs_blkoff(*offset)]);
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  140  	if (!len)
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  141  		len = U16_MAX + 1;
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  142  	buffer = kmalloc(len, GFP_KERNEL);
6477e408d41152 fs/erofs/super.c              Gao Xiang 2021-12-29  143  	if (!buffer)
6477e408d41152 fs/erofs/super.c              Gao Xiang 2021-12-29  144  		return ERR_PTR(-ENOMEM);
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  145  	*offset += sizeof(__le16);
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  146  	*lengthp = len;
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  147  
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  148  	for (i = 0; i < len; i += cnt) {
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  149  		cnt = min(EROFS_BLKSIZ - (int)erofs_blkoff(*offset), len - i);
6477e408d41152 fs/erofs/super.c              Gao Xiang 2021-12-29  150  		ptr = erofs_read_metabuf(buf, sb, erofs_blknr(*offset),
6477e408d41152 fs/erofs/super.c              Gao Xiang 2021-12-29  151  					 EROFS_KMAP);
6477e408d41152 fs/erofs/super.c              Gao Xiang 2021-12-29  152  		if (IS_ERR(ptr))
6477e408d41152 fs/erofs/super.c              Gao Xiang 2021-12-29 @153  			return ptr;

"buffer" not freed on error path.

14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  154  		memcpy(buffer + i, ptr + erofs_blkoff(*offset), cnt);
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  155  		*offset += cnt;
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  156  	}
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  157  	return buffer;
14373711dd54be fs/erofs/super.c              Gao Xiang 2021-03-29  158  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org