From: "Miquel Sabaté Solà" <mssola@mssola.com>
To: linux-btrfs@vger.kernel.org
Cc: clm@fb.com, dsterba@suse.com, wqu@suse.com,
linux-kernel@vger.kernel.org,
"Miquel Sabaté Solà" <mssola@mssola.com>,
"Boris Burkov" <boris@bur.io>
Subject: [PATCH v2] btrfs: ioctl: Fix memory leak on duplicated memory
Date: Thu, 25 Sep 2025 20:41:39 +0200 [thread overview]
Message-ID: <20250925184139.403156-1-mssola@mssola.com> (raw)
On 'btrfs_ioctl_qgroup_assign' we first duplicate the argument as
provided by the user, which is kfree'd in the end. But this was not the
case when allocating memory for 'prealloc'. In this case, if it somehow
failed, then the previous code would go directly into calling
'mnt_drop_write_file', without freeing the string duplicated from the
user space.
Fixes: 4addc1ffd67a ("btrfs: qgroup: preallocate memory before adding a relation")
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Miquel Sabaté Solà <mssola@mssola.com>
---
fs/btrfs/ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 185bef0df1c2..8cb7d5a462ef 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3740,7 +3740,7 @@ static long btrfs_ioctl_qgroup_assign(struct file *file, void __user *arg)
prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL);
if (!prealloc) {
ret = -ENOMEM;
- goto drop_write;
+ goto out;
}
}
--
2.51.0
next reply other threads:[~2025-09-25 18:42 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-25 18:41 Miquel Sabaté Solà [this message]
2025-09-26 9:04 ` [PATCH v2] btrfs: ioctl: Fix memory leak on duplicated memory Filipe Manana
2025-09-26 9:36 ` Miquel Sabaté Solà
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250925184139.403156-1-mssola@mssola.com \
--to=mssola@mssola.com \
--cc=boris@bur.io \
--cc=clm@fb.com \
--cc=dsterba@suse.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=wqu@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox