Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b35905c1 authored by Aneesh Kumar K.V's avatar Aneesh Kumar K.V Committed by Theodore Ts'o
Browse files

ext4: Fix memory and buffer head leak in callers to ext4_ext_find_extent() 



The path variable returned via ext4_ext_find_extent is a kmalloc
variable and needs to be freeded.  It also contains a reference to
buffer_head which needs to be dropped.

Signed-off-by: default avatarAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: default avatarMingming Cao <cmm@us.ibm.com>
Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
parent 4cdeed86

fs/ext4/extents.c

+3 −3
Original line number Diff line number Diff line
@@ -349,7 +349,7 @@ static void ext4_ext_show_leaf(struct inode *inode, struct ext4_ext_path *path) 
#define ext4_ext_show_leaf(inode,path)

#endif



static void ext4_ext_drop_refs(struct ext4_ext_path *path)

void ext4_ext_drop_refs(struct ext4_ext_path *path)

{

	int depth = path->p_depth;

	int i;
@@ -2200,10 +2200,10 @@ static int ext4_ext_convert_to_initialized(handle_t *handle, 
		newdepth = ext_depth(inode);

		if (newdepth != depth) {

			depth = newdepth;

			path = ext4_ext_find_extent(inode, iblock, NULL);

			ext4_ext_drop_refs(path);

			path = ext4_ext_find_extent(inode, iblock, path);

			if (IS_ERR(path)) {

				err = PTR_ERR(path);

				path = NULL;

				goto out;

			}

			eh = path[depth].p_hdr;

fs/ext4/migrate.c

+5 −0
Original line number Diff line number Diff line
@@ -43,6 +43,7 @@ static int finish_range(handle_t *handle, struct inode *inode, 


	if (IS_ERR(path)) {

		retval = PTR_ERR(path);

		path = NULL;

		goto err_out;

	}
@@ -74,6 +75,10 @@ static int finish_range(handle_t *handle, struct inode *inode, 
	}

	retval = ext4_ext_insert_extent(handle, inode, path, &newext);

err_out:

	if (path) {

		ext4_ext_drop_refs(path);

		kfree(path);

	}

	lb->first_pblock = 0;

	return retval;

}

include/linux/ext4_fs_extents.h

+1 −0
Original line number Diff line number Diff line
@@ -227,5 +227,6 @@ extern int ext4_ext_search_left(struct inode *, struct ext4_ext_path *, 
						ext4_lblk_t *, ext4_fsblk_t *);

extern int ext4_ext_search_right(struct inode *, struct ext4_ext_path *,

						ext4_lblk_t *, ext4_fsblk_t *);

extern void ext4_ext_drop_refs(struct ext4_ext_path *);

#endif /* _LINUX_EXT4_EXTENTS */