Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b0e2eee1 authored by Phillip Lougher's avatar Phillip Lougher Committed by Greg Kroah-Hartman
Browse files

squashfs: fix memory leak in squashfs_fill_super 

commit b64700d41bdc4e9f82f1346c15a3678ebb91a89c upstream.

If sb_min_blocksize returns 0, squashfs_fill_super exits without freeing
allocated memory (sb->s_fs_info).

Fix this by moving the call to sb_min_blocksize to before memory is
allocated.

Link: https://lkml.kernel.org/r/20250811223740.110392-1-phillip@squashfs.org.uk


Fixes: 734aa85390ea ("Squashfs: check return result of sb_min_blocksize")
Signed-off-by: default avatarPhillip Lougher <phillip@squashfs.org.uk>
Reported-by: default avatarScott GUO <scottzhguo@tencent.com>
Closes: https://lore.kernel.org/all/20250811061921.3807353-1-scott_gzh@163.com


Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c4ebc069

fs/squashfs/super.c

+7 −7
Original line number Diff line number Diff line
@@ -74,10 +74,15 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc) 
	unsigned short flags;

	unsigned int fragments;

	u64 lookup_table_start, xattr_id_table_start, next_table;

	int err;

	int err, devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);



	TRACE("Entered squashfs_fill_superblock\n");



	if (!devblksize) {

		errorf(fc, "squashfs: unable to set blocksize\n");

		return -EINVAL;

	}



	sb->s_fs_info = kzalloc(sizeof(*msblk), GFP_KERNEL);

	if (sb->s_fs_info == NULL) {

		ERROR("Failed to allocate squashfs_sb_info\n");
@@ -85,12 +90,7 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc) 
	}

	msblk = sb->s_fs_info;



	msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);

	if (!msblk->devblksize) {

		errorf(fc, "squashfs: unable to set blocksize\n");

		return -EINVAL;

	}



	msblk->devblksize = devblksize;

	msblk->devblksize_log2 = ffz(~msblk->devblksize);



	mutex_init(&msblk->meta_index_mutex);