Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5bed3387 authored by Filipe Manana's avatar Filipe Manana Committed by Greg Kroah-Hartman
Browse files

btrfs: fix memory leaks after failure to lookup checksums during inode logging 



commit 4f26433e9b3eb7a55ed70d8f882ae9cd48ba448b upstream.

While logging an inode, at copy_items(), if we fail to lookup the checksums
for an extent we release the destination path, free the ins_data array and
then return immediately. However a previous iteration of the for loop may
have added checksums to the ordered_sums list, in which case we leak the
memory used by them.

So fix this by making sure we iterate the ordered_sums list and free all
its checksums before returning.

Fixes: 3650860b ("Btrfs: remove almost all of the BUG()'s from tree-log.c")
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: default avatarJohannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f1d21b26

fs/btrfs/tree-log.c

+2 −6
Original line number Diff line number Diff line
@@ -4040,11 +4040,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, 
						fs_info->csum_root,

						ds + cs, ds + cs + cl - 1,

						&ordered_sums, 0);

				if (ret) {

					btrfs_release_path(dst_path);

					kfree(ins_data);

					return ret;

				}

				if (ret)

					break;

			}

		}

	}
@@ -4057,7 +4054,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, 
	 * we have to do this after the loop above to avoid changing the

	 * log tree while trying to change the log tree.

	 */

	ret = 0;

	while (!list_empty(&ordered_sums)) {

		struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next,

						   struct btrfs_ordered_sum,