Commit 040d159a authored Feb 24, 2026 by Max Kellermann Committed by Ilya Dryomov Mar 09, 2026

ceph: fix memory leaks in ceph_mdsc_build_path()



Add __putname() calls to error code paths that did not free the "path"
pointer obtained by __getname().  If ownership of this pointer is not
passed to the caller via path_info.path, the function must free it
before returning.

Cc: stable@vger.kernel.org
Fixes: 3fd945a7 ("ceph: encode encrypted name in ceph_mdsc_build_path and dentry release")
Fixes: 550f7ca9 ("ceph: give up on paths longer than PATH_MAX")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

parent 43323a59

fs/ceph/mds_client.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -2768,6 +2768,7 @@ char ceph_mdsc_build_path(struct ceph_mds_client mdsc, struct dentry *dentry,
		if (ret < 0) {
		dput(parent);
		dput(cur);
		__putname(path);
		return ERR_PTR(ret);
		}

		@@ -2777,6 +2778,7 @@ char ceph_mdsc_build_path(struct ceph_mds_client mdsc, struct dentry *dentry,
		if (len < 0) {
		dput(parent);
		dput(cur);
		__putname(path);
		return ERR_PTR(len);
		}
		}
		@@ -2813,6 +2815,7 @@ char ceph_mdsc_build_path(struct ceph_mds_client mdsc, struct dentry *dentry,
		* cannot ever succeed. Creating paths that long is
		* possible with Ceph, but Linux cannot use them.
		*/
		__putname(path);
		return ERR_PTR(-ENAMETOOLONG);
		}