diff options
| author | Daniel Yang <danielyangkang@gmail.com> | 2024-09-17 02:05:06 +0300 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2024-09-23 15:38:13 +0300 |
| commit | c290fe508eee36df1640c3cb35dc8f89e073c8a8 (patch) | |
| tree | ea0a0e0c1d7b0fb1623967dd6c2d2f223135591d /fs/exfat | |
| parent | 6630ea49103c3d45461e29b0f6eb0ce750aeb8f5 (diff) | |
| download | linux-c290fe508eee36df1640c3cb35dc8f89e073c8a8.tar.xz | |
exfat: resolve memory leak from exfat_create_upcase_table()
If exfat_load_upcase_table reaches end and returns -EINVAL,
allocated memory doesn't get freed and while
exfat_load_default_upcase_table allocates more memory, leading to a
memory leak.
Here's link to syzkaller crash report illustrating this issue:
https://syzkaller.appspot.com/text?tag=CrashReport&x=1406c201980000
Reported-by: syzbot+e1c69cadec0f1a078e3d@syzkaller.appspotmail.com
Fixes: a13d1a4de3b0 ("exfat: move freeing sbi, upcase table and dropping nls into rcu-delayed helper")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Yang <danielyangkang@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Diffstat (limited to 'fs/exfat')
| -rw-r--r-- | fs/exfat/nls.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c index afdf13c34ff5..1ac011088ce7 100644 --- a/fs/exfat/nls.c +++ b/fs/exfat/nls.c @@ -779,8 +779,11 @@ int exfat_create_upcase_table(struct super_block *sb) le32_to_cpu(ep->dentry.upcase.checksum)); brelse(bh); - if (ret && ret != -EIO) + if (ret && ret != -EIO) { + /* free memory from exfat_load_upcase_table call */ + exfat_free_upcase_table(sbi); goto load_default; + } /* load successfully */ return ret; |