diff options
| author | Zhihao Cheng <chengzhihao1@huawei.com> | 2022-11-18 17:02:36 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-03-11 16:31:57 +0100 |
| commit | 5759076fc7c54614084002345a21bc2c578bf4a8 (patch) | |
| tree | bc9302ec0f460748d502a3d93d75d26174996e8c | |
| parent | 437e010c8b87a850f5da7727a3587ee66cbcf63e (diff) | |
| download | linux-5759076fc7c54614084002345a21bc2c578bf4a8.tar.gz linux-5759076fc7c54614084002345a21bc2c578bf4a8.tar.bz2 linux-5759076fc7c54614084002345a21bc2c578bf4a8.zip | |
ubifs: dirty_cow_znode: Fix memleak in error handling path
[ Upstream commit 122deabfe1428bffe95e2bf364ff8a5059bdf089 ]
Following process will cause a memleak for copied up znode:
dirty_cow_znode
zn = copy_znode(c, znode);
err = insert_old_idx(c, zbr->lnum, zbr->offs);
if (unlikely(err))
return ERR_PTR(err); // No one refers to zn.
Fix it by adding copied znode back to tnc, then it will be freed
by ubifs_destroy_tnc_subtree() while closing tnc.
Fetch a reproducer in [Link].
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216705
Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/ubifs/tnc.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c index 2073aa706c83..4665c4d7d76a 100644 --- a/fs/ubifs/tnc.c +++ b/fs/ubifs/tnc.c @@ -279,11 +279,18 @@ static struct ubifs_znode *dirty_cow_znode(struct ubifs_info *c, if (zbr->len) { err = insert_old_idx(c, zbr->lnum, zbr->offs); if (unlikely(err)) - return ERR_PTR(err); + /* + * Obsolete znodes will be freed by tnc_destroy_cnext() + * or free_obsolete_znodes(), copied up znodes should + * be added back to tnc and freed by + * ubifs_destroy_tnc_subtree(). + */ + goto out; err = add_idx_dirt(c, zbr->lnum, zbr->len); } else err = 0; +out: zbr->znode = zn; zbr->lnum = 0; zbr->offs = 0; |