Commit 53a4acbf authored by Miquel Sabaté Solà's avatar Miquel Sabaté Solà Committed by David Sterba
Browse files

btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl 



On 'btrfs_ioctl_qgroup_assign' we first duplicate the argument as
provided by the user, which is kfree'd in the end. But this was not the
case when allocating memory for 'prealloc'. In this case, if it somehow
failed, then the previous code would go directly into calling
'mnt_drop_write_file', without freeing the string duplicated from the
user space.

Fixes: 4addc1ff ("btrfs: qgroup: preallocate memory before adding a relation")
CC: stable@vger.kernel.org # 6.12+
Reviewed-by: default avatarBoris Burkov <boris@bur.io>
Reviewed-by: default avatarFilipe Manana <fdmanana@suse.com>
Signed-off-by: default avatarMiquel Sabaté Solà <mssola@mssola.com>
Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 7e5a5983

fs/btrfs/ioctl.c

+1 −1
Original line number Diff line number Diff line
@@ -3740,7 +3740,7 @@ static long btrfs_ioctl_qgroup_assign(struct file *file, void __user *arg) 
		prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL);

		if (!prealloc) {

			ret = -ENOMEM;

			goto drop_write;

			goto out;

		}

	}