linux-kernel - [PATCH] gfs2: Fix memory leak in init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20221104123104.628576-1-lizetao1@huawei.com>
Date:   Fri, 4 Nov 2022 20:31:04 +0800
From:   Li Zetao <lizetao1@...wei.com>
To:     <rpeterso@...hat.com>, <agruenba@...hat.com>,
        <teigland@...hat.com>, <swhiteho@...hat.com>
CC:     <lizetao1@...wei.com>, <yi.zhang@...wei.com>,
        <zhangxiaoxu5@...wei.com>, <cluster-devel@...hat.com>,
        <linux-kernel@...r.kernel.org>
Subject: [PATCH] gfs2: Fix memory leak in init_journal()

There is a memory leak report by kmemleak:

  unreferenced object 0xffff8881786ff9a0 (size 192):
    comm "mount", pid 8881, jiffies 4301165942 (age 892.453s)
    hex dump (first 32 bytes):
      e0 ef 6f 78 81 88 ff ff 70 95 2a 04 81 88 ff ff  ..ox....p.*.....
      b0 f9 6f 78 81 88 ff ff b0 f9 6f 78 81 88 ff ff  ..ox......ox....
    backtrace:
      [<ffffffff8170ea67>] kmalloc_trace+0x27/0xa0
      [<ffffffffa0a15465>] init_inodes+0x495/0x2010 [gfs2]
      [<ffffffffa0a1bc27>] gfs2_fill_super+0x18c7/0x25b0 [gfs2]
      [<ffffffff818e1626>] get_tree_bdev+0x3e6/0x6e0
      [<ffffffffa0a13a34>] gfs2_get_tree+0x44/0x220 [gfs2]
      [<ffffffff818de91d>] vfs_get_tree+0x7d/0x230
      [<ffffffff81958073>] path_mount+0xd63/0x1760
      [<ffffffff81958b3a>] do_mount+0xca/0xe0
      [<ffffffff81958e1c>] __x64_sys_mount+0x12c/0x1a0
      [<ffffffff82f2e485>] do_syscall_64+0x35/0x80
      [<ffffffff8300006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

The root cause was traced to an error handling path in init_journal()
when gfs2_jindex_hold() fails. The GFS2 superblock will hold a list
of "gfs2_jdesc", and some of them are not freed in error handling path
"fail" when gfs2_jindex_hold() fails.

Fix it by freeing the memory of "gfs2_jdesc" allocated in the loop in
gfs2_jindex_hold() when an error occurs.

Fixes: b3b94faa5fe5 ("[GFS2] The core of GFS2")
Signed-off-by: Li Zetao <lizetao1@...wei.com>
---
 fs/gfs2/ops_fstype.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index c0cf1d2d0ef5..b55bee96619e 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -625,6 +625,9 @@ static int gfs2_jindex_hold(struct gfs2_sbd *sdp, struct gfs2_holder *ji_gh)
 		spin_unlock(&sdp->sd_jindex_spin);
 	}
 
+	if (error)
+		gfs2_jindex_free(sdp);
+
 	mutex_unlock(&sdp->sd_jindex_mutex);
 
 	return error;
-- 
2.25.1