linux-kernel - Re: [PATCH] btrfs: fix memory leak when rejecting a non SINGLE data profile without an RST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e82bb44e-5f56-4ddc-976a-9ff268a5b705@wdc.com>
Date: Tue, 7 Oct 2025 10:13:18 +0000
From: Johannes Thumshirn <Johannes.Thumshirn@....com>
To: Miquel Sabaté Solà <mssola@...ola.com>,
	"linux-btrfs@...r.kernel.org" <linux-btrfs@...r.kernel.org>
CC: "clm@...com" <clm@...com>, "dsterba@...e.com" <dsterba@...e.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] btrfs: fix memory leak when rejecting a non SINGLE data
 profile without an RST

On 10/7/25 7:55 AM, Miquel Sabaté Solà wrote:
> At the end of btrfs_load_block_group_zone_info() the first thing we do
> is to ensure that if the mapping type is not a SINGLE one and there is
> no RAID stripe tree, then we return early with an error.
>
> Doing that, though, prevents the code from running the last calls from
> this function which are about freeing memory allocated during its
> run. Hence, in this case, instead of returning early go to the freeing
> section of this function and leave then.
>
> Signed-off-by: Miquel Sabaté Solà <mssola@...ola.com>
> ---
>   fs/btrfs/zoned.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c
> index e3341a84f4ab..b0f5d61dbfd2 100644
> --- a/fs/btrfs/zoned.c
> +++ b/fs/btrfs/zoned.c
> @@ -1753,7 +1753,8 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new)
>   	    !fs_info->stripe_root) {
>   		btrfs_err(fs_info, "zoned: data %s needs raid-stripe-tree",
>   			  btrfs_bg_type_to_raid_name(map->type));
> -		return -EINVAL;
> +		ret = -EINVAL;
> +		goto out_free;
>   	}
>   
>   	if (unlikely(cache->alloc_offset > cache->zone_capacity)) {
> @@ -1785,6 +1786,8 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new)
>   		btrfs_free_chunk_map(cache->physical_map);
>   		cache->physical_map = NULL;
>   	}
> +
> +out_free:
>   	bitmap_free(active);
>   	kfree(zone_info);
>   

Wouldn't it make more sense to only set "ret = -EINVAL" and run the rest 
of the functions cleanup? I.e. with your patch the chunk_map isn't freed 
as well.