Commit 510b80ab authored Nov 18, 2022 by Zhihao Cheng Committed by Greg Kroah-Hartman Mar 11, 2023

ubifs: dirty_cow_znode: Fix memleak in error handling path

[ Upstream commit 122deabfe1428bffe95e2bf364ff8a5059bdf089 ]

Following process will cause a memleak for copied up znode:

dirty_cow_znode
  zn = copy_znode(c, znode);
  err = insert_old_idx(c, zbr->lnum, zbr->offs);
  if (unlikely(err))
     return ERR_PTR(err);   // No one refers to zn.

Fix it by adding copied znode back to tnc, then it will be freed
by ubifs_destroy_tnc_subtree() while closing tnc.

Fetch a reproducer in [Link].

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216705


Fixes: 1e51764a ("UBIFS: add new flash file system")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 0875edca

fs/ubifs/tnc.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -267,11 +267,18 @@ static struct ubifs_znode dirty_cow_znode(struct ubifs_info c,
		if (zbr->len) {
		err = insert_old_idx(c, zbr->lnum, zbr->offs);
		if (unlikely(err))
		return ERR_PTR(err);
		/*
		* Obsolete znodes will be freed by tnc_destroy_cnext()
		* or free_obsolete_znodes(), copied up znodes should
		* be added back to tnc and freed by
		* ubifs_destroy_tnc_subtree().
		*/
		goto out;
		err = add_idx_dirt(c, zbr->lnum, zbr->len);
		} else
		err = 0;

		out:
		zbr->znode = zn;
		zbr->lnum = 0;
		zbr->offs = 0;