lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <tencent_5A915E07B07A5564B9DA65F6F002EBD91209@qq.com>
Date: Tue, 30 Sep 2025 18:04:48 +0800
From: Haofeng Li <920484857@...com>
To: linux-f2fs-devel@...ts.sourceforge.net
Cc: 13266079573@....com,
	920484857@...com,
	chao@...nel.org,
	jaegeuk@...nel.org,
	lihaofeng@...inos.cn,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] f2fs: fix ifolio memory leak in f2fs_move_inline_dirents error path

>Fixes a memory leak issue in f2fs_move_inline_dirents() where
>the ifolio is not properly released in certain error paths.

>Problem Analysis:
>- In f2fs_try_convert_inline_dir(), ifolio is acquired via f2fs_get_inode_folio()
>- When do_convert_inline_dir() fails, the caller expects ifolio to be released
>- However, in f2fs_move_inline_dirents(), two specific error paths don't release ifolio

Add some additional information.

When do_convert_inline_dir() fails in f2fs_try_convert_inline_dir(),
the ifolio obtained via f2fs_get_inode_folio() is not properly released,
leading to a memory leak.

The issue occurs in the following call path:

f2fs_try_convert_inline_dir()
├── f2fs_get_inode_folio()  // acquires ifolio
├── do_convert_inline_dir()
│   ├── f2fs_move_inline_dirents() // The issue is in this function. 
│   │   └── Error paths may not release ifolio
└── Only releases ifolio on success: if (!err) f2fs_folio_put(ifolio, true)

Specifically, in f2fs_move_inline_dirents():
- If f2fs_reserve_block() fails, the function jumps to 'out' label
- The 'out' label only releases the newly allocated 'folio' but not 'ifolio'
- This leaves ifolio unreleased when f2fs_reserve_block() fails

In contrast, f2fs_move_rehashed_dirents() properly handles ifolio release
in its error recovery path, but the inconsistency creates a leak risk.


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ