Commit f2aae745 authored by Zhihao Cheng's avatar Zhihao Cheng Committed by Richard Weinberger
Browse files

ubifs: xattr: Fix some potential memory leaks while iterating entries 



Fix some potential memory leaks in error handling branches while
iterating xattr entries. For example, function ubifs_tnc_remove_ino()
forgets to free pxent if it exists. Similar problems also exist in
ubifs_purge_xattrs(), ubifs_add_orphan() and ubifs_jnl_write_inode().

Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
Cc: <stable@vger.kernel.org>
Fixes: 1e51764a ("UBIFS: add new flash file system")
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
parent e4c26faa

fs/ubifs/journal.c

+2 −0
Original line number Diff line number Diff line
@@ -894,6 +894,7 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode) 
				if (err == -ENOENT)

					break;



				kfree(pxent);

				goto out_release;

			}
@@ -906,6 +907,7 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode) 
				ubifs_err(c, "dead directory entry '%s', error %d",

					  xent->name, err);

				ubifs_ro_mode(c, err);

				kfree(pxent);

				kfree(xent);

				goto out_release;

			}

fs/ubifs/orphan.c

+2 −0
Original line number Diff line number Diff line
@@ -173,6 +173,7 @@ int ubifs_add_orphan(struct ubifs_info *c, ino_t inum) 
			err = PTR_ERR(xent);

			if (err == -ENOENT)

				break;

			kfree(pxent);

			return err;

		}
@@ -182,6 +183,7 @@ int ubifs_add_orphan(struct ubifs_info *c, ino_t inum) 


		xattr_orphan = orphan_add(c, xattr_inum, orphan);

		if (IS_ERR(xattr_orphan)) {

			kfree(pxent);

			kfree(xent);

			return PTR_ERR(xattr_orphan);

		}

fs/ubifs/tnc.c

+3 −0
Original line number Diff line number Diff line
@@ -2885,6 +2885,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum) 
			err = PTR_ERR(xent);

			if (err == -ENOENT)

				break;

			kfree(pxent);

			return err;

		}
@@ -2898,6 +2899,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum) 
		fname_len(&nm) = le16_to_cpu(xent->nlen);

		err = ubifs_tnc_remove_nm(c, &key1, &nm);

		if (err) {

			kfree(pxent);

			kfree(xent);

			return err;

		}
@@ -2906,6 +2908,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum) 
		highest_ino_key(c, &key2, xattr_inum);

		err = ubifs_tnc_remove_range(c, &key1, &key2);

		if (err) {

			kfree(pxent);

			kfree(xent);

			return err;

		}

fs/ubifs/xattr.c

+2 −0
Original line number Diff line number Diff line
@@ -522,6 +522,7 @@ int ubifs_purge_xattrs(struct inode *host) 
				  xent->name, err);

			ubifs_ro_mode(c, err);

			kfree(pxent);

			kfree(xent);

			return err;

		}
@@ -531,6 +532,7 @@ int ubifs_purge_xattrs(struct inode *host) 
		err = remove_xattr(c, host, xino, &nm);

		if (err) {

			kfree(pxent);

			kfree(xent);

			iput(xino);

			ubifs_err(c, "cannot remove xattr, error %d", err);

			return err;

CRA Git | Maintained and supported by SUSTech CRA and CCSE