udf: Fix memory leak when mounting

commit a7be300de800e755714c71103ae4a0d205e41e99 upstream.

udf_process_sequence() allocates temporary array for processing
partition descriptors on volume which it fails to free. Free the array
when it is not needed anymore.

Fixes: 7b78fd02fb19 ("udf: Fix handling of Partition Descriptors")
CC: stable@vger.kernel.org
Reported-by: syzbot+128f4dd6e796c98b3760@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/udf/super.c b/fs/udf/super.c
index a03b8ce5ef0fde19b50c92484fd7d760fb1a6165..fca3f5b590782043afbc69c4660394b35dc3fcc0 100644 (file)
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1704,7 +1704,8 @@ static noinline int udf_process_sequence(
                                        "Pointers (max %u supported)\n",
                                        UDF_MAX_TD_NESTING);
                                brelse(bh);
-                               return -EIO;
+                               ret = -EIO;
+                               goto out;
                        }
 
                        vdp = (struct volDescPtr *)bh->b_data;
@@ -1724,7 +1725,8 @@ static noinline int udf_process_sequence(
                        curr = get_volume_descriptor_record(ident, bh, &data);
                        if (IS_ERR(curr)) {
                                brelse(bh);
-                               return PTR_ERR(curr);
+                               ret = PTR_ERR(curr);
+                               goto out;
                        }
                        /* Descriptor we don't care about? */
                        if (!curr)
@@ -1746,28 +1748,31 @@ static noinline int udf_process_sequence(
         */
        if (!data.vds[VDS_POS_PRIMARY_VOL_DESC].block) {
                udf_err(sb, "Primary Volume Descriptor not found!\n");
-               return -EAGAIN;
+               ret = -EAGAIN;
+               goto out;
        }
        ret = udf_load_pvoldesc(sb, data.vds[VDS_POS_PRIMARY_VOL_DESC].block);
        if (ret < 0)
-               return ret;
+               goto out;
 
        if (data.vds[VDS_POS_LOGICAL_VOL_DESC].block) {
                ret = udf_load_logicalvol(sb,
                                data.vds[VDS_POS_LOGICAL_VOL_DESC].block,
                                fileset);
                if (ret < 0)
-                       return ret;
+                       goto out;
        }
 
        /* Now handle prevailing Partition Descriptors */
        for (i = 0; i < data.num_part_descs; i++) {
                ret = udf_load_partdesc(sb, data.part_descs_loc[i].rec.block);
                if (ret < 0)
-                       return ret;
+                       goto out;
        }
-
-       return 0;
+       ret = 0;
+out:
+       kfree(data.part_descs_loc);
+       return ret;
 }
 
 /*