Re: [PATCH 4/8] erofs-utils: lib: fix buffer leaks in error paths

[Gao Xiang <xiang@kernel.org>]

Hi Yifan,

On Thu, Nov 12, 2026 at 08:47:21PM +0800, Yifan Zhao wrote:
> Fragment data is already written before its buffer is shrunk.
> A failed realloc() should leave the original buffer valid, so the
> fragment commit can continue without shrinking it.
> 
> Also fix an inline data buffer leak when loading compressed metadata
> fails during rebuild.
> 
> Fixes: 84bae6acdbee ("erofs-utils: lib: keep full data until the fragment is committed")
> Fixes: 1c230a485f25 ("erofs-utils: mkfs: support rebuild mode for compressed inodes")
> Assisted-by: Codex:gpt-6-astra
> Assisted-by: Claude Code:deepseek-v4.1-flash-1017
> Signed-off-by: Yifan Zhao <stopire@gmail.com>
> ---
>  lib/compress.c  | 2 ++
>  lib/fragments.c | 8 ++------
>  2 files changed, 4 insertions(+), 6 deletions(-)
> 
> diff --git a/lib/compress.c b/lib/compress.c
> index e1cfc05..b5f75ca 100644
> --- a/lib/compress.c
> +++ b/lib/compress.c
> @@ -2607,6 +2607,8 @@ int z_erofs_rebuild_load_metadata(struct erofs_sb_info *dst_sbi,
>  err_free_ei:
>  	free(ei);
>  err_out:
> +	free(inode->idata);
> +	inode->idata = NULL;
>  	list_for_each_entry_safe(ei, n, &extents, list) {
>  		list_del(&ei->list);
>  		free(ei);

Can we use a separate patch to fix that?

> diff --git a/lib/fragments.c b/lib/fragments.c
> index d4e79b2..3398888 100644
> --- a/lib/fragments.c
> +++ b/lib/fragments.c
> @@ -366,12 +366,8 @@ int erofs_fragment_commit(struct erofs_inode *inode, u32 tofh)
>  		memmove(fi->data, fi->data + fi->length - sz, sz);
>  
>  		nb = realloc(fi->data, sz);
> -		if (!nb) {
> -			erofs_up_write(&bk->lock);
> -			fi->data = NULL;
> -			return -ENOMEM;
> -		}
> -		fi->data = nb;
> +		if (nb)
> +			fi->data = nb;

Does this one impact the reproducibility?

I mean that if realloc fails, we should just error out instead of
falling back, otherwise the generated image can be different.


Thanks,
Gao Xiang
>  		fi->pos = (erofs_off_t)offset;
>  		erofs_up_write(&bk->lock);
>  		inode->fragmentoff = fi->pos - len;
> -- 
> 2.56.0
> 
>