Commit 6a379f67 authored Aug 19, 2019 by Wenwen Wang Committed by Richard Weinberger Sep 15, 2019

jffs2: Fix memory leak in jffs2_scan_eraseblock() error path



In jffs2_scan_eraseblock(), 'sumptr' is allocated through kmalloc() if
'sumlen' is larger than 'buf_size'. However, it is not deallocated in the
following execution if jffs2_fill_scan_buf() fails, leading to a memory
leak bug. To fix this issue, free 'sumptr' before returning the error.

Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Signed-off-by: Richard Weinberger <richard@nod.at>

parent 61b875e8

fs/jffs2/scan.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -527,10 +527,13 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
		err = jffs2_fill_scan_buf(c, sumptr,
		jeb->offset + c->sector_size - sumlen,
		sumlen - buf_len);
		if (err)
		if (err) {
		if (sumlen > buf_size)
		kfree(sumptr);
		return err;
		}
		}
		}

		}

Admin message