linux-kernel - Re: [PATCH] f2fs: fix ifolio memory leak in f2fs_move_inline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_5A915E07B07A5564B9DA65F6F002EBD91209@qq.com>
Date: Tue, 30 Sep 2025 18:04:48 +0800
From: Haofeng Li <920484857@...com>
To: linux-f2fs-devel@...ts.sourceforge.net
Cc: 13266079573@....com,
	920484857@...com,
	chao@...nel.org,
	jaegeuk@...nel.org,
	lihaofeng@...inos.cn,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] f2fs: fix ifolio memory leak in f2fs_move_inline_dirents error path

>Fixes a memory leak issue in f2fs_move_inline_dirents() where
>the ifolio is not properly released in certain error paths.

>Problem Analysis:
>- In f2fs_try_convert_inline_dir(), ifolio is acquired via f2fs_get_inode_folio()
>- When do_convert_inline_dir() fails, the caller expects ifolio to be released
>- However, in f2fs_move_inline_dirents(), two specific error paths don't release ifolio

Add some additional information.

When do_convert_inline_dir() fails in f2fs_try_convert_inline_dir(),
the ifolio obtained via f2fs_get_inode_folio() is not properly released,
leading to a memory leak.

The issue occurs in the following call path:

f2fs_try_convert_inline_dir()
├── f2fs_get_inode_folio()  // acquires ifolio
├── do_convert_inline_dir()
│   ├── f2fs_move_inline_dirents() // The issue is in this function. 
│   │   └── Error paths may not release ifolio
└── Only releases ifolio on success: if (!err) f2fs_folio_put(ifolio, true)

Specifically, in f2fs_move_inline_dirents():
- If f2fs_reserve_block() fails, the function jumps to 'out' label
- The 'out' label only releases the newly allocated 'folio' but not 'ifolio'
- This leaves ifolio unreleased when f2fs_reserve_block() fails

In contrast, f2fs_move_rehashed_dirents() properly handles ifolio release
in its error recovery path, but the inconsistency creates a leak risk.