linux-kernel - Re: [PATCH v2] btrfs: ioctl: Fix memory leak on duplicated memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAL3q7H53nu8sGuDCbWzsVFHf5g1ybsRVrdyN6WaET61mk-g3mA@mail.gmail.com>
Date: Fri, 26 Sep 2025 10:04:13 +0100
From: Filipe Manana <fdmanana@...nel.org>
To: Miquel Sabaté Solà <mssola@...ola.com>
Cc: linux-btrfs@...r.kernel.org, clm@...com, dsterba@...e.com, wqu@...e.com, 
	linux-kernel@...r.kernel.org, Boris Burkov <boris@....io>
Subject: Re: [PATCH v2] btrfs: ioctl: Fix memory leak on duplicated memory

On Thu, Sep 25, 2025 at 11:42 PM Miquel Sabaté Solà <mssola@...ola.com> wrote:
>
> On 'btrfs_ioctl_qgroup_assign' we first duplicate the argument as
> provided by the user, which is kfree'd in the end. But this was not the
> case when allocating memory for 'prealloc'. In this case, if it somehow
> failed, then the previous code would go directly into calling
> 'mnt_drop_write_file', without freeing the string duplicated from the
> user space.
>
> Fixes: 4addc1ffd67a ("btrfs: qgroup: preallocate memory before adding a relation")
> Reviewed-by: Boris Burkov <boris@....io>
> Signed-off-by: Miquel Sabaté Solà <mssola@...ola.com>

Reviewed-by: Filipe Manana <fdmanana@...e.com>

I pushed it  into the for-next branch [1] with a changed subject to:

btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl

Note that we don't capitalize the first word after the prefix in the subject.
I also made it more specific by mentioning which ioctl, since we have many.

Thanks.

[1] https://github.com/btrfs/linux/commits/for-next/

> ---
>  fs/btrfs/ioctl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> index 185bef0df1c2..8cb7d5a462ef 100644
> --- a/fs/btrfs/ioctl.c
> +++ b/fs/btrfs/ioctl.c
> @@ -3740,7 +3740,7 @@ static long btrfs_ioctl_qgroup_assign(struct file *file, void __user *arg)
>                 prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL);
>                 if (!prealloc) {
>                         ret = -ENOMEM;
> -                       goto drop_write;
> +                       goto out;
>                 }
>         }
>
> --
> 2.51.0
>