udf: Fix memory leak when mounting

udf_process_sequence() allocates temporary array for processing
partition descriptors on volume which it fails to free. Free the array
when it is not needed anymore.

Fixes: 7b78fd02fb19 ("udf: Fix handling of Partition Descriptors")
CC: stable@vger.kernel.org
Reported-by: syzbot+128f4dd6e796c98b3760@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>

diff --git a/fs/udf/super.c b/fs/udf/super.c
index 8b381456482d9a9a6a3c8915f6c7c249885d3b09..a76025de67104ff88b2b485bace80939c10ad4d6 100644 (file)
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1690,7 +1690,8 @@ static noinline int udf_process_sequence(
                                        "Pointers (max %u supported)\n",
                                        UDF_MAX_TD_NESTING);
                                brelse(bh);
-                               return -EIO;
+                               ret = -EIO;
+                               goto out;
                        }
 
                        vdp = (struct volDescPtr *)bh->b_data;
@@ -1710,7 +1711,8 @@ static noinline int udf_process_sequence(
                        curr = get_volume_descriptor_record(ident, bh, &data);
                        if (IS_ERR(curr)) {
                                brelse(bh);
-                               return PTR_ERR(curr);
+                               ret = PTR_ERR(curr);
+                               goto out;
                        }
                        /* Descriptor we don't care about? */
                        if (!curr)
@@ -1732,28 +1734,31 @@ static noinline int udf_process_sequence(
         */
        if (!data.vds[VDS_POS_PRIMARY_VOL_DESC].block) {
                udf_err(sb, "Primary Volume Descriptor not found!\n");
-               return -EAGAIN;
+               ret = -EAGAIN;
+               goto out;
        }
        ret = udf_load_pvoldesc(sb, data.vds[VDS_POS_PRIMARY_VOL_DESC].block);
        if (ret < 0)
-               return ret;
+               goto out;
 
        if (data.vds[VDS_POS_LOGICAL_VOL_DESC].block) {
                ret = udf_load_logicalvol(sb,
                                data.vds[VDS_POS_LOGICAL_VOL_DESC].block,
                                fileset);
                if (ret < 0)
-                       return ret;
+                       goto out;
        }
 
        /* Now handle prevailing Partition Descriptors */
        for (i = 0; i < data.num_part_descs; i++) {
                ret = udf_load_partdesc(sb, data.part_descs_loc[i].rec.block);
                if (ret < 0)
-                       return ret;
+                       goto out;
        }
-
-       return 0;
+       ret = 0;
+out:
+       kfree(data.part_descs_loc);
+       return ret;
 }
 
 /*