Commit d61504b9 authored by Christian Engelmayer's avatar Christian Engelmayer Committed by Greg Kroah-Hartman

btrfs: fix possible leak in btrfs_ioctl_balance()

commit 0f89abf5 upstream.

Commit 8eb93459 ("btrfs: check unsupported filters in balance
arguments") adds a jump to exit label out_bargs in case the argument
check fails. At this point in addition to the bargs memory, the
memory for struct btrfs_balance_control has already been allocated.
Ownership of bctl is passed to btrfs_balance() in the good case,
thus the memory is not freed due to the introduced jump. Make sure
that the memory gets freed in any case as necessary. Detected by
Coverity CID 1328378.
Signed-off-by: default avatarChristian Engelmayer <cengelma@gmx.at>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarChris Mason <clm@fb.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e7bbf66d
......@@ -4649,7 +4649,7 @@ static long btrfs_ioctl_balance(struct file *file, void __user *arg)
if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) {
ret = -EINVAL;
goto out_bargs;
goto out_bctl;
}
do_balance:
......@@ -4663,12 +4663,15 @@ static long btrfs_ioctl_balance(struct file *file, void __user *arg)
need_unlock = false;
ret = btrfs_balance(bctl, bargs);
bctl = NULL;
if (arg) {
if (copy_to_user(arg, bargs, sizeof(*bargs)))
ret = -EFAULT;
}
out_bctl:
kfree(bctl);
out_bargs:
kfree(bargs);
out_unlock:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment