Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9bbfd657 authored by Jan Kara's avatar Jan Kara Committed by Greg Kroah-Hartman
Browse files

udf: Fix memory leak when mounting 



commit a7be300de800e755714c71103ae4a0d205e41e99 upstream.

udf_process_sequence() allocates temporary array for processing
partition descriptors on volume which it fails to free. Free the array
when it is not needed anymore.

Fixes: 7b78fd02 ("udf: Fix handling of Partition Descriptors")
CC: stable@vger.kernel.org
Reported-by: default avatar <syzbot+128f4dd6e796c98b3760@syzkaller.appspotmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d8a2bd86

fs/udf/super.c

+13 −8
Original line number Diff line number Diff line
@@ -1685,7 +1685,8 @@ static noinline int udf_process_sequence( 
					"Pointers (max %u supported)\n",

					UDF_MAX_TD_NESTING);

				brelse(bh);

				return -EIO;

				ret = -EIO;

				goto out;

			}



			vdp = (struct volDescPtr *)bh->b_data;
@@ -1705,7 +1706,8 @@ static noinline int udf_process_sequence( 
			curr = get_volume_descriptor_record(ident, bh, &data);

			if (IS_ERR(curr)) {

				brelse(bh);

				return PTR_ERR(curr);

				ret = PTR_ERR(curr);

				goto out;

			}

			/* Descriptor we don't care about? */

			if (!curr)
@@ -1727,28 +1729,31 @@ static noinline int udf_process_sequence( 
	 */

	if (!data.vds[VDS_POS_PRIMARY_VOL_DESC].block) {

		udf_err(sb, "Primary Volume Descriptor not found!\n");

		return -EAGAIN;

		ret = -EAGAIN;

		goto out;

	}

	ret = udf_load_pvoldesc(sb, data.vds[VDS_POS_PRIMARY_VOL_DESC].block);

	if (ret < 0)

		return ret;

		goto out;



	if (data.vds[VDS_POS_LOGICAL_VOL_DESC].block) {

		ret = udf_load_logicalvol(sb,

				data.vds[VDS_POS_LOGICAL_VOL_DESC].block,

				fileset);

		if (ret < 0)

			return ret;

			goto out;

	}



	/* Now handle prevailing Partition Descriptors */

	for (i = 0; i < data.num_part_descs; i++) {

		ret = udf_load_partdesc(sb, data.part_descs_loc[i].rec.block);

		if (ret < 0)

			return ret;

			goto out;

	}



	return 0;

	ret = 0;

out:

	kfree(data.part_descs_loc);

	return ret;

}



/*