aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChristian Engelmayer <cengelma@gmx.at>2015-10-20 18:50:06 -0400
committerChris Mason <clm@fb.com>2015-10-21 21:10:02 -0400
commit0f89abf56abbd0e1c6e3cef9813e6d9f05383c1e (patch)
treef89024b26a6294f420e5957c191f53cb778d6d62
parent0f6925fa2907df58496cabc33fa4677c635e2223 (diff)
btrfs: fix possible leak in btrfs_ioctl_balance()
Commit 8eb934591f8b ("btrfs: check unsupported filters in balance arguments") adds a jump to exit label out_bargs in case the argument check fails. At this point in addition to the bargs memory, the memory for struct btrfs_balance_control has already been allocated. Ownership of bctl is passed to btrfs_balance() in the good case, thus the memory is not freed due to the introduced jump. Make sure that the memory gets freed in any case as necessary. Detected by Coverity CID 1328378. Signed-off-by: Christian Engelmayer <cengelma@gmx.at> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: Chris Mason <clm@fb.com>
-rw-r--r--fs/btrfs/ioctl.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 3e3e6130637f..8d20f3b1cab0 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4641,7 +4641,7 @@ locked:
4641 4641
4642 if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) { 4642 if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) {
4643 ret = -EINVAL; 4643 ret = -EINVAL;
4644 goto out_bargs; 4644 goto out_bctl;
4645 } 4645 }
4646 4646
4647do_balance: 4647do_balance:
@@ -4655,12 +4655,15 @@ do_balance:
4655 need_unlock = false; 4655 need_unlock = false;
4656 4656
4657 ret = btrfs_balance(bctl, bargs); 4657 ret = btrfs_balance(bctl, bargs);
4658 bctl = NULL;
4658 4659
4659 if (arg) { 4660 if (arg) {
4660 if (copy_to_user(arg, bargs, sizeof(*bargs))) 4661 if (copy_to_user(arg, bargs, sizeof(*bargs)))
4661 ret = -EFAULT; 4662 ret = -EFAULT;
4662 } 4663 }
4663 4664
4665out_bctl:
4666 kfree(bctl);
4664out_bargs: 4667out_bargs:
4665 kfree(bargs); 4668 kfree(bargs);
4666out_unlock: 4669out_unlock: