| Message ID | 20240916230506.232137-1-danielyangkang@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v3] fs/exfat: resolve memory leak from exfat_create_upcase_table() | expand |
On Tue, Sep 17, 2024 at 8:05 AM Daniel Yang <danielyangkang@gmail.com> wrote: > > If exfat_load_upcase_table reaches end and returns -EINVAL, > allocated memory doesn't get freed and while > exfat_load_default_upcase_table allocates more memory, leading to a > memory leak. > > Here's link to syzkaller crash report illustrating this issue: > https://syzkaller.appspot.com/text?tag=CrashReport&x=1406c201980000 > > Signed-off-by: Daniel Yang <danielyangkang@gmail.com> > Reported-by: syzbot+e1c69cadec0f1a078e3d@syzkaller.appspotmail.com > --- > V2 -> V3: free(NULL) is no-op, removed if() check > V1 -> V2: Moved the mem free to create_upcase_table Applied it to #dev now. Thanks for your work!
diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c index afdf13c34..1ac011088 100644 --- a/fs/exfat/nls.c +++ b/fs/exfat/nls.c @@ -779,8 +779,11 @@ int exfat_create_upcase_table(struct super_block *sb) le32_to_cpu(ep->dentry.upcase.checksum)); brelse(bh); - if (ret && ret != -EIO) + if (ret && ret != -EIO) { + /* free memory from exfat_load_upcase_table call */ + exfat_free_upcase_table(sbi); goto load_default; + } /* load successfully */ return ret;
If exfat_load_upcase_table reaches end and returns -EINVAL, allocated memory doesn't get freed and while exfat_load_default_upcase_table allocates more memory, leading to a memory leak. Here's link to syzkaller crash report illustrating this issue: https://syzkaller.appspot.com/text?tag=CrashReport&x=1406c201980000 Signed-off-by: Daniel Yang <danielyangkang@gmail.com> Reported-by: syzbot+e1c69cadec0f1a078e3d@syzkaller.appspotmail.com --- V2 -> V3: free(NULL) is no-op, removed if() check V1 -> V2: Moved the mem free to create_upcase_table fs/exfat/nls.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)