Commit 10256f00 authored by Zhihao Cheng's avatar Zhihao Cheng Committed by Richard Weinberger
Browse files

ubifs: do_kill_orphans: Fix a memory leak bug 



If there are more than one valid snod on the sleb->nodes list,
do_kill_orphans will malloc ino more than once without releasing
previous ino's memory. Finally, it will trigger memory leak.

Fixes: ee1438ce ("ubifs: Check link count of inodes when...")
Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
parent 91cbf011

fs/ubifs/orphan.c

+10 −7
Original line number Diff line number Diff line
@@ -631,12 +631,17 @@ static int do_kill_orphans(struct ubifs_info *c, struct ubifs_scan_leb *sleb, 
	ino_t inum;

	int i, n, err, first = 1;



	ino = kmalloc(UBIFS_MAX_INO_NODE_SZ, GFP_NOFS);

	if (!ino)

		return -ENOMEM;



	list_for_each_entry(snod, &sleb->nodes, list) {

		if (snod->type != UBIFS_ORPH_NODE) {

			ubifs_err(c, "invalid node type %d in orphan area at %d:%d",

				  snod->type, sleb->lnum, snod->offs);

			ubifs_dump_node(c, snod->node);

			return -EINVAL;

			err = -EINVAL;

			goto out_free;

		}



		orph = snod->node;
@@ -663,20 +668,18 @@ static int do_kill_orphans(struct ubifs_info *c, struct ubifs_scan_leb *sleb, 
				ubifs_err(c, "out of order commit number %llu in orphan node at %d:%d",

					  cmt_no, sleb->lnum, snod->offs);

				ubifs_dump_node(c, snod->node);

				return -EINVAL;

				err = -EINVAL;

				goto out_free;

			}

			dbg_rcvry("out of date LEB %d", sleb->lnum);

			*outofdate = 1;

			return 0;

			err = 0;

			goto out_free;

		}



		if (first)

			first = 0;



		ino = kmalloc(UBIFS_MAX_INO_NODE_SZ, GFP_NOFS);

		if (!ino)

			return -ENOMEM;



		n = (le32_to_cpu(orph->ch.len) - UBIFS_ORPH_NODE_SZ) >> 3;

		for (i = 0; i < n; i++) {

			union ubifs_key key1, key2;

CRA Git | Maintained and supported by SUSTech CRA and CCSE