Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bcachefs: fix memleak in bch2_split_devs

The pointer dev_name can be modified by strseq(),
then causes the memleak:

unreferenced object 0xffff9d08a2916c80 (size 32):
comm "mount.bcachefs", pid 9090, jiffies 4295856224 (age 17.564s)
hex dump (first 32 bytes):
2f 64 65 76 2f 6d 61 70 70 65 72 2f 74 65 73 74 /dev/mapper/test
2d 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -0..............
backtrace:
[<00000000c5d3be7d>] __kmem_cache_alloc_node+0x1f3/0x2c0
[<0000000052215d26>] __kmalloc_node_track_caller+0x51/0x150
[<0000000069fea956>] kstrdup+0x32/0x60
[<000000000877fcf1>] bch2_split_devs+0x3f/0x150 [bcachefs]
[<000000007ee93204>] bch2_mount+0xcb/0x640 [bcachefs]
[<000000002dd1e04b>] legacy_get_tree+0x30/0x60
[<000000006afc31d3>] vfs_get_tree+0x28/0xf0
[<000000007b0c538e>] path_mount+0x475/0xb60
[<0000000092de5882>] __x64_sys_mount+0x105/0x140
[<0000000054fc05d8>] do_syscall_64+0x42/0xf0
[<00000000df584910>] entry_SYSCALL_64_after_hwframe+0x6e/0x76

Fix it by copy pointer dev_name at beginning and free the copied
pointer at end.

Signed-off-by: Su Yue <glass.su@suse.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>

authored by

Su Yue and committed by
Kent Overstreet
e240c1b3 169de419

+5 -3
+5 -3
fs/bcachefs/util.c
··· 1186 1186 { 1187 1187 darray_init(ret); 1188 1188 1189 - char *dev_name = kstrdup(_dev_name, GFP_KERNEL), *s = dev_name; 1189 + char *dev_name, *s, *orig; 1190 + 1191 + dev_name = orig = kstrdup(_dev_name, GFP_KERNEL); 1190 1192 if (!dev_name) 1191 1193 return -ENOMEM; 1192 1194 ··· 1203 1201 } 1204 1202 } 1205 1203 1206 - kfree(dev_name); 1204 + kfree(orig); 1207 1205 return 0; 1208 1206 err: 1209 1207 bch2_darray_str_exit(ret); 1210 - kfree(dev_name); 1208 + kfree(orig); 1211 1209 return -ENOMEM; 1212 1210 }