linux-kernel - Re: [PATCH v1] erofs: fix possible memory leak in z_erofs_gbuf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <00e92d3f-7bdd-44b8-8a2f-ea07fd47d040@linux.alibaba.com>
Date: Tue, 25 Jun 2024 09:02:40 +0800
From: Gao Xiang <hsiangkao@...ux.alibaba.com>
To: Sandeep Dhavale <dhavale@...gle.com>, linux-erofs@...ts.ozlabs.org,
 Gao Xiang <xiang@...nel.org>, Chao Yu <chao@...nel.org>,
 Yue Hu <huyue2@...lpad.com>, Jeffle Xu <jefflexu@...ux.alibaba.com>,
 Chunhai Guo <guochunhai@...o.com>
Cc: kernel-team@...roid.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1] erofs: fix possible memory leak in z_erofs_gbuf_exit()



On 2024/6/25 06:02, Sandeep Dhavale wrote:
> Because we incorrectly reused of variable `i` in `z_erofs_gbuf_exit()`
> for inner loop, we may exit early from outer loop resulting in memory
> leak. Fix this by using separate variable for iterating through inner loop.
> 
> Fixes: f36f3010f676 ("erofs: rename per-CPU buffers to global buffer pool and make it configurable")
> 
> Signed-off-by: Sandeep Dhavale <dhavale@...gle.com>

Reviewed-by: Gao Xiang <hsiangkao@...ux.alibaba.com>

Thanks,
Gao Xiang

> ---
>   fs/erofs/zutil.c | 8 ++++----
>   1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/erofs/zutil.c b/fs/erofs/zutil.c
> index 036024bce9f7..b80f612867c2 100644
> --- a/fs/erofs/zutil.c
> +++ b/fs/erofs/zutil.c
> @@ -148,7 +148,7 @@ int __init z_erofs_gbuf_init(void)
>   
>   void z_erofs_gbuf_exit(void)
>   {
> -	int i;
> +	int i, j;
>   
>   	for (i = 0; i < z_erofs_gbuf_count + (!!z_erofs_rsvbuf); ++i) {
>   		struct z_erofs_gbuf *gbuf = &z_erofs_gbufpool[i];
> @@ -161,9 +161,9 @@ void z_erofs_gbuf_exit(void)
>   		if (!gbuf->pages)
>   			continue;
>   
> -		for (i = 0; i < gbuf->nrpages; ++i)
> -			if (gbuf->pages[i])
> -				put_page(gbuf->pages[i]);
> +		for (j = 0; j < gbuf->nrpages; ++j)
> +			if (gbuf->pages[j])
> +				put_page(gbuf->pages[j]);
>   		kfree(gbuf->pages);
>   		gbuf->pages = NULL;
>   	}