aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristian Engelmayer <cengelma@gmx.at>2015-10-21 00:50:06 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2015-11-09 14:33:39 -0800
commitee03d02ebc5dd0ee414fc47eb3992e8d3aa7396e (patch)
tree96e99aa9d8fdf194a7002b6fd810ca97124c9cd0
parentd35e462164987724e4a1d20a55351e52181464aa (diff)
downloadlinux-linaro-stable-ee03d02ebc5dd0ee414fc47eb3992e8d3aa7396e.tar.gz
btrfs: fix possible leak in btrfs_ioctl_balance()
commit 0f89abf56abbd0e1c6e3cef9813e6d9f05383c1e upstream. Commit 8eb934591f8b ("btrfs: check unsupported filters in balance arguments") adds a jump to exit label out_bargs in case the argument check fails. At this point in addition to the bargs memory, the memory for struct btrfs_balance_control has already been allocated. Ownership of bctl is passed to btrfs_balance() in the good case, thus the memory is not freed due to the introduced jump. Make sure that the memory gets freed in any case as necessary. Detected by Coverity CID 1328378. Signed-off-by: Christian Engelmayer <cengelma@gmx.at> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: Chris Mason <clm@fb.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--fs/btrfs/ioctl.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index af3dd3c55ef1..8b2c82ce36b3 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4494,7 +4494,7 @@ locked:
if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) {
ret = -EINVAL;
- goto out_bargs;
+ goto out_bctl;
}
do_balance:
@@ -4508,12 +4508,15 @@ do_balance:
need_unlock = false;
ret = btrfs_balance(bctl, bargs);
+ bctl = NULL;
if (arg) {
if (copy_to_user(arg, bargs, sizeof(*bargs)))
ret = -EFAULT;
}
+out_bctl:
+ kfree(bctl);
out_bargs:
kfree(bargs);
out_unlock: