linux-kernel - Re: [PATCH] btrfs: ioctl: Fix memory leak on duplicated memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250925174731.GQ5333@suse.cz>
Date: Thu, 25 Sep 2025 19:47:31 +0200
From: David Sterba <dsterba@...e.cz>
To: Boris Burkov <boris@....io>
Cc: Miquel Sabaté Solà <mssola@...ola.com>,
	linux-btrfs@...r.kernel.org, clm@...com, dsterba@...e.com,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] btrfs: ioctl: Fix memory leak on duplicated memory

On Thu, Sep 25, 2025 at 10:25:29AM -0700, Boris Burkov wrote:
> On Thu, Sep 25, 2025 at 04:53:31PM +0200, Miquel Sabaté Solà wrote:
> > On 'btrfs_ioctl_qgroup_assign' we first duplicate the argument as
> > provided by the user, which is kfree'd in the end. But this was not the
> > case when allocating memory for 'prealloc'. In this case, if it somehow
> > failed, then the previous code would go directly into calling
> > 'mnt_drop_write_file', without freeing the string duplicated from the
> > user space.
> > 
> > Signed-off-by: Miquel Sabaté Solà <mssola@...ola.com>
> 
> LGTM, thanks for the fix!
> 
> One thing though: I don't like the label names. I think with multiple
> cleanups the best way is to name each label with the cleanup it is for.
> Once you have some named ones, "out" feels unspecific, and encoding
> every single action like "out_sa_drop_write" doesn't scale as you add
> more cleanups, so it's just not a useful pattern. It's already quite
> clunky with just two.

The patch is adding a new label and it follows the pattern we use
elsewhere, with "out_<what>" pattern. The standalone 'out' is there and
I agree it should be named like 'out_free_prealloc' or such but it's in
the original code and it's been there for a long time. Cleaning that up
is for another patch.