• Al Viro's avatar
    exfat: fix memory leak in exfat_parse_param() · f341a7d8
    Al Viro authored
    butt3rflyh4ck reported memory leak found by syzkaller.
    
    A param->string held by exfat_mount_options.
    
    BUG: memory leak
    
    unreferenced object 0xffff88801972e090 (size 8):
      comm "syz-executor.2", pid 16298, jiffies 4295172466 (age 14.060s)
      hex dump (first 8 bytes):
        6b 6f 69 38 2d 75 00 00                          koi8-u..
      backtrace:
        [<000000005bfe35d6>] kstrdup+0x36/0x70 mm/util.c:60
        [<0000000018ed3277>] exfat_parse_param+0x160/0x5e0
    fs/exfat/super.c:276
        [<000000007680462b>] vfs_parse_fs_param+0x2b4/0x610
    fs/fs_context.c:147
        [<0000000097c027f2>] vfs_parse_fs_string+0xe6/0x150
    fs/fs_context.c:191
        [<00000000371bf78f>] generic_parse_monolithic+0x16f/0x1f0
    fs/fs_context.c:231
        [<000000005ce5eb1b>] do_new_mount fs/namespace.c:2812 [inline]
        [<000000005ce5eb1b>] do_mount+0x12bb/0x1b30 fs/namespace.c:3141
        [<00000000b642040c>] __do_sys_mount fs/namespace.c:3350 [inline]
        [<00000000b642040c>] __se_sys_mount fs/namespace.c:3327 [inline]
        [<00000000b642040c>] __x64_sys_mount+0x18f/0x230 fs/namespace.c:3327
        [<000000003b024e98>] do_syscall_64+0xf6/0x7d0
    arch/x86/entry/common.c:295
        [<00000000ce2b698c>] entry_SYSCALL_64_after_hwframe+0x49/0xb3
    
    exfat_free() should call exfat_free_iocharset(), to prevent a leak
    in case we fail after parsing iocharset= but before calling
    get_tree_bdev().
    
    Additionally, there's no point copying param->string in
    exfat_parse_param() - just steal it, leaving NULL in param->string.
    That's independent from the leak or fix thereof - it's simply
    avoiding an extra copy.
    
    Fixes: 719c1e18 ("exfat: add super block operations")
    Cc: stable@vger.kernel.org # v5.7
    Reported-by: default avatarbutt3rflyh4ck <butterflyhuangxx@gmail.com>
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: default avatarNamjae Jeon <namjae.jeon@samsung.com>
    f341a7d8
super.c 19.6 KB