linux-kernel - Re: [PATCH v2 fs/btrfs v2] btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAL3q7H7XbPrJUyXoiBfixY02Fp_PsL3AKVrLq=1FQpBtkCsFPg@mail.gmail.com>
Date: Sat, 25 Oct 2025 20:36:16 +0100
From: Filipe Manana <fdmanana@...nel.org>
To: Shardul Bankar <shardulsb08@...il.com>
Cc: linux-btrfs@...r.kernel.org, clm@...com, dsterba@...e.com, 
	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v2 fs/btrfs v2] btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation

On Sat, Oct 25, 2025 at 1:05 PM Shardul Bankar <shardulsb08@...il.com> wrote:
>
> When btrfs_add_qgroup_relation() is called with invalid qgroup levels
> (src >= dst), the function returns -EINVAL directly without freeing the
> preallocated qgroup_list structure passed by the caller. This causes a
> memory leak because the caller unconditionally sets the pointer to NULL
> after the call, preventing any cleanup.
>
> The issue occurs because the level validation check happens before the
> mutex is acquired and before any error handling path that would free
> the prealloc pointer. On this early return, the cleanup code at the
> 'out' label (which includes kfree(prealloc)) is never reached.
>
> In btrfs_ioctl_qgroup_assign(), the code pattern is:
>
>     prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL);
>     ret = btrfs_add_qgroup_relation(trans, sa->src, sa->dst, prealloc);
>     prealloc = NULL;  // Always set to NULL regardless of return value
>     ...
>     kfree(prealloc);  // This becomes kfree(NULL), does nothing
>
> When the level check fails, 'prealloc' is never freed by either the
> callee or the caller, resulting in a 64-byte memory leak per failed
> operation. This can be triggered repeatedly by an unprivileged user
> with access to a writable btrfs mount, potentially exhausting kernel
> memory.
>
> Fix this by freeing prealloc before the early return, ensuring prealloc
> is always freed on all error paths.
>
> Fixes: 8465ecec9611 ("btrfs: Check qgroup level in kernel qgroup assign.")

This is completely wrong...
When that commit landed we didn't even have the 'prealloc'...

The right commit is:

4addc1ffd67a ("btrfs: qgroup: preallocate memory before adding a relation")

> Cc: stable@...r.kernel.org # v4.0+

And this becomes 6.11. But with a Fixes tag we pretty much don't need
it, stable scripts will figure everything out.

Thanks.


> Signed-off-by: Shardul Bankar <shardulsb08@...il.com>
> ---
>
> v2:
>  - Free prealloc directly before returning -EINVAL (no mutex held),
>    per review from Qu Wenruo.
>  - Drop goto-based cleanup.
>
>  fs/btrfs/qgroup.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
> index 1175b8192cd7..31ad8580322a 100644
> --- a/fs/btrfs/qgroup.c
> +++ b/fs/btrfs/qgroup.c
> @@ -1539,8 +1539,10 @@ int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans, u64 src, u64 dst
>         ASSERT(prealloc);
>
>         /* Check the level of src and dst first */
> -       if (btrfs_qgroup_level(src) >= btrfs_qgroup_level(dst))
> +       if (btrfs_qgroup_level(src) >= btrfs_qgroup_level(dst)) {
> +               kfree(prealloc);
>                 return -EINVAL;
> +       }
>
>         mutex_lock(&fs_info->qgroup_ioctl_lock);
>         if (!fs_info->quota_root) {
> --
> 2.34.1
>
>