ubifs: xattr: Fix some potential memory leaks while iterating entries

commit f2aae745b82c842221f4f233051f9ac641790959 upstream.

Fix some potential memory leaks in error handling branches while
iterating xattr entries. For example, function ubifs_tnc_remove_ino()
forgets to free pxent if it exists. Similar problems also exist in
ubifs_purge_xattrs(), ubifs_add_orphan() and ubifs_jnl_write_inode().

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: <stable@vger.kernel.org>
Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index 5f2ac5ef0891e74e3a311472616df456665f2348..037b7a7549f5c90c1a2ceeef9922557da0e647b3 100644 (file)
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -894,6 +894,7 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode)
                                if (err == -ENOENT)
                                        break;
 
+                               kfree(pxent);
                                goto out_release;
                        }
 
@@ -906,6 +907,7 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode)
                                ubifs_err(c, "dead directory entry '%s', error %d",
                                          xent->name, err);
                                ubifs_ro_mode(c, err);
+                               kfree(pxent);
                                kfree(xent);
                                goto out_release;
                        }

diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
index 283f9eb48410d9d8aeb9f07979ea89eebb825aab..b0117878b3a0cec99d1a356d18d0beab9fb260a7 100644 (file)
--- a/fs/ubifs/orphan.c
+++ b/fs/ubifs/orphan.c
@@ -173,6 +173,7 @@ int ubifs_add_orphan(struct ubifs_info *c, ino_t inum)
                        err = PTR_ERR(xent);
                        if (err == -ENOENT)
                                break;
+                       kfree(pxent);
                        return err;
                }
 
@@ -182,6 +183,7 @@ int ubifs_add_orphan(struct ubifs_info *c, ino_t inum)
 
                xattr_orphan = orphan_add(c, xattr_inum, orphan);
                if (IS_ERR(xattr_orphan)) {
+                       kfree(pxent);
                        kfree(xent);
                        return PTR_ERR(xattr_orphan);
                }

diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index e8e7b0e9532e81ed757a34ed26def2ae27005212..33742ee3945b3432c782f582eb25ba5e0d3cd4dc 100644 (file)
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -2885,6 +2885,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum)
                        err = PTR_ERR(xent);
                        if (err == -ENOENT)
                                break;
+                       kfree(pxent);
                        return err;
                }
 
@@ -2898,6 +2899,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum)
                fname_len(&nm) = le16_to_cpu(xent->nlen);
                err = ubifs_tnc_remove_nm(c, &key1, &nm);
                if (err) {
+                       kfree(pxent);
                        kfree(xent);
                        return err;
                }
@@ -2906,6 +2908,7 @@ int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum)
                highest_ino_key(c, &key2, xattr_inum);
                err = ubifs_tnc_remove_range(c, &key1, &key2);
                if (err) {
+                       kfree(pxent);
                        kfree(xent);
                        return err;
                }

diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
index 9aefbb60074ffbff5ca094e2cb2dbe25e436c212..a0b9b349efe65a27471b2e2cc0fe78480b056d80 100644 (file)
--- a/fs/ubifs/xattr.c
+++ b/fs/ubifs/xattr.c
@@ -522,6 +522,7 @@ int ubifs_purge_xattrs(struct inode *host)
                                  xent->name, err);
                        ubifs_ro_mode(c, err);
                        kfree(pxent);
+                       kfree(xent);
                        return err;
                }
 
@@ -531,6 +532,7 @@ int ubifs_purge_xattrs(struct inode *host)
                err = remove_xattr(c, host, xino, &nm);
                if (err) {
                        kfree(pxent);
+                       kfree(xent);
                        iput(xino);
                        ubifs_err(c, "cannot remove xattr, error %d", err);
                        return err;