linux-kernel - Re: [PATCH] autofs: Fix memory leak in autofs_fill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c8a82305-1c55-4c21-b0e0-e19a6ef9b543@themaw.net>
Date: Sat, 27 Dec 2025 08:25:05 +0800
From: Ian Kent <raven@...maw.net>
To: Zilin Guan <zilin@....edu.cn>
Cc: autofs@...r.kernel.org, linux-kernel@...r.kernel.org,
 jianhao.xu@....edu.cn
Subject: Re: [PATCH] autofs: Fix memory leak in autofs_fill_super()

On 25/12/25 22:27, Zilin Guan wrote:
> The autofs_new_ino() function allocates a new autofs_info structure.
> If the subsequent call to autofs_get_inode() fails, this structure is
> not freed, leading to a memory leak.
>
> Fix this by adding a new error label to free the structure and jumping
> to it upon failure.
>
> While at it, consolidate the error handling for the d_make_root()
> failure case to use the same label.
>
> Fixes: 66917f85db600 ("autofs: add: new_inode check in autofs_fill_super()")
> Signed-off-by: Zilin Guan <zilin@....edu.cn>

Acked-by: Ian Kent <raven@...maw.net>


So obvious, one wonders how things like this go unseen for so long, ;)


Ian

> ---
>   fs/autofs/inode.c | 13 ++++++++-----
>   1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
> index b932b1719dfc..391979f8b2bb 100644
> --- a/fs/autofs/inode.c
> +++ b/fs/autofs/inode.c
> @@ -324,7 +324,7 @@ static int autofs_fill_super(struct super_block *s, struct fs_context *fc)
>   
>   	root_inode = autofs_get_inode(s, S_IFDIR | 0755);
>   	if (!root_inode)
> -		return -ENOMEM;
> +		goto nomem;
>   
>   	root_inode->i_uid = ctx->uid;
>   	root_inode->i_gid = ctx->gid;
> @@ -332,10 +332,9 @@ static int autofs_fill_super(struct super_block *s, struct fs_context *fc)
>   	root_inode->i_op = &autofs_dir_inode_operations;
>   
>   	s->s_root = d_make_root(root_inode);
> -	if (unlikely(!s->s_root)) {
> -		autofs_free_ino(ino);
> -		return -ENOMEM;
> -	}
> +	if (unlikely(!s->s_root))
> +		goto nomem;
> +
>   	s->s_root->d_fsdata = ino;
>   
>   	if (ctx->pgrp_set) {
> @@ -358,6 +357,10 @@ static int autofs_fill_super(struct super_block *s, struct fs_context *fc)
>   
>   	sbi->flags &= ~AUTOFS_SBI_CATATONIC;
>   	return 0;
> +
> +nomem:
> +	autofs_free_ino(ino);
> +	return -ENOMEM;
>   }
>   
>   /*