Commit a7be300d authored by Jan Kara's avatar Jan Kara
Browse files

udf: Fix memory leak when mounting



udf_process_sequence() allocates temporary array for processing
partition descriptors on volume which it fails to free. Free the array
when it is not needed anymore.

Fixes: 7b78fd02 ("udf: Fix handling of Partition Descriptors")
CC: stable@vger.kernel.org
Reported-by: default avatar <syzbot+128f4dd6e796c98b3760@syzkaller.appspotmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent aa9f6661
Loading
Loading
Loading
Loading
+13 −8
Original line number Diff line number Diff line
@@ -1690,7 +1690,8 @@ static noinline int udf_process_sequence(
					"Pointers (max %u supported)\n",
					UDF_MAX_TD_NESTING);
				brelse(bh);
				return -EIO;
				ret = -EIO;
				goto out;
			}

			vdp = (struct volDescPtr *)bh->b_data;
@@ -1710,7 +1711,8 @@ static noinline int udf_process_sequence(
			curr = get_volume_descriptor_record(ident, bh, &data);
			if (IS_ERR(curr)) {
				brelse(bh);
				return PTR_ERR(curr);
				ret = PTR_ERR(curr);
				goto out;
			}
			/* Descriptor we don't care about? */
			if (!curr)
@@ -1732,28 +1734,31 @@ static noinline int udf_process_sequence(
	 */
	if (!data.vds[VDS_POS_PRIMARY_VOL_DESC].block) {
		udf_err(sb, "Primary Volume Descriptor not found!\n");
		return -EAGAIN;
		ret = -EAGAIN;
		goto out;
	}
	ret = udf_load_pvoldesc(sb, data.vds[VDS_POS_PRIMARY_VOL_DESC].block);
	if (ret < 0)
		return ret;
		goto out;

	if (data.vds[VDS_POS_LOGICAL_VOL_DESC].block) {
		ret = udf_load_logicalvol(sb,
				data.vds[VDS_POS_LOGICAL_VOL_DESC].block,
				fileset);
		if (ret < 0)
			return ret;
			goto out;
	}

	/* Now handle prevailing Partition Descriptors */
	for (i = 0; i < data.num_part_descs; i++) {
		ret = udf_load_partdesc(sb, data.part_descs_loc[i].rec.block);
		if (ret < 0)
			return ret;
			goto out;
	}

	return 0;
	ret = 0;
out:
	kfree(data.part_descs_loc);
	return ret;
}

/*