From: Bingwu Zhang <xtex@envs.net>
To: linux-erofs <linux-erofs@lists.ozlabs.org>, Gao Xiang <xiang@kernel.org>
Cc: Bingwu Zhang <xtex@astrafall.org>
Subject: [PATCH RESEND] erofs-utils: lib: fix memory leak in erofs_fragment_commit
Date: Wed, 29 Jul 2026 16:55:27 +0800 [thread overview]
Message-ID: <20260729085527.124698-1-xtex@envs.net> (raw)
From: Bingwu Zhang <xtex@astrafall.org>
erofs_fragment_pack may initialize fi->list as a
new list head instead of adding it to a bucket.
If fi->pos is non-zero, the fragmentitem and
data buffer is not released by erofs_fragment_commit,
leading to a memory leak.
Signed-off-by: Bingwu Zhang <xtex@astrafall.org>
---
Reproducer:
mkfs.erofs -d9 -Eztailpacking -Einline_data \
-Efragments -zzstd --zD data.erofs data
Direct leak of 5080 byte(s) in 127 object(s) allocated from:
#0 0x559bf549b788 in malloc (/home/xtex/src/erofs/erofs-utils/mkfs/mkfs.erofs+0x10f788)
#1 0x559bf554391e in erofs_fragment_pack /home/xtex/src/erofs/erofs-utils/lib/fragments.c:205:7
#2 0x559bf554426a in erofs_pack_file_from_fd /home/xtex/src/erofs/erofs-utils/lib/fragments.c:302:7
#3 0x559bf552e89f in erofs_write_compress_dir /home/xtex/src/erofs/erofs-utils/lib/compress.c:2074:8
#4 0x559bf5507421 in erofs_write_dir_file /home/xtex/src/erofs/erofs-utils/lib/inode.c:744:9
#5 0x559bf5507421 in erofs_mkfs_jobfn /home/xtex/src/erofs/erofs-utils/lib/inode.c:1654:9
#6 0x559bf5507421 in z_erofs_mt_dfops_worker /home/xtex/src/erofs/erofs-utils/lib/inode.c:1723:9
#7 0x559bf5498fca in asan_thread_start(void*) asan_interceptors.cpp.o
Indirect leak of 7135 byte(s) in 127 object(s) allocated from:
#0 0x559bf549b788 in malloc (/home/xtex/src/erofs/erofs-utils/mkfs/mkfs.erofs+0x10f788)
#1 0x559bf55439c5 in erofs_fragment_pack /home/xtex/src/erofs/erofs-utils/lib/fragments.c:218:13
#2 0x559bf554426a in erofs_pack_file_from_fd /home/xtex/src/erofs/erofs-utils/lib/fragments.c:302:7
#3 0x559bf552e89f in erofs_write_compress_dir /home/xtex/src/erofs/erofs-utils/lib/compress.c:2074:8
#4 0x559bf5507421 in erofs_write_dir_file /home/xtex/src/erofs/erofs-utils/lib/inode.c:744:9
#5 0x559bf5507421 in erofs_mkfs_jobfn /home/xtex/src/erofs/erofs-utils/lib/inode.c:1654:9
#6 0x559bf5507421 in z_erofs_mt_dfops_worker /home/xtex/src/erofs/erofs-utils/lib/inode.c:1723:9
#7 0x559bf5498fca in asan_thread_start(void*) asan_interceptors.cpp.o
---
lib/fragments.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/lib/fragments.c b/lib/fragments.c
index 13afce3be537..f137e41b7365 100644
--- a/lib/fragments.c
+++ b/lib/fragments.c
@@ -325,6 +325,10 @@ int erofs_fragment_commit(struct erofs_inode *inode, u32 tofh)
if (fi->pos) {
inode->fragmentoff = fi->pos - len;
+ if (list_empty(&fi->list)) {
+ free(fi->data);
+ free(fi);
+ }
return 0;
}
---
base-commit: 30711d4b2e234fe3e8aaeb779ade4cb609b0d920
change-id: 20260706-fix-frag-leak-f7a6cf172168
Best regards,
--
Bingwu Zhang <xtex@astrafall.org>
reply other threads:[~2026-07-29 8:55 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260729085527.124698-1-xtex@envs.net \
--to=xtex@envs.net \
--cc=linux-erofs@lists.ozlabs.org \
--cc=xiang@kernel.org \
--cc=xtex@astrafall.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox