[PATCH RESEND] erofs-utils: lib: fix memory leak in erofs_fragment_commit

[PATCH RESEND] erofs-utils: lib: fix memory leak in erofs_fragment_commit

[Bingwu Zhang]

From: Bingwu Zhang <xtex@astrafall.org>

erofs_fragment_pack may initialize fi->list as a
new list head instead of adding it to a bucket.
If fi->pos is non-zero, the fragmentitem and
data buffer is not released by erofs_fragment_commit,
leading to a memory leak.

Signed-off-by: Bingwu Zhang <xtex@astrafall.org>
---
Reproducer:
mkfs.erofs -d9 -Eztailpacking -Einline_data \
	-Efragments -zzstd --zD data.erofs data

Direct leak of 5080 byte(s) in 127 object(s) allocated from:
    #0 0x559bf549b788 in malloc (/home/xtex/src/erofs/erofs-utils/mkfs/mkfs.erofs+0x10f788)
    #1 0x559bf554391e in erofs_fragment_pack /home/xtex/src/erofs/erofs-utils/lib/fragments.c:205:7
    #2 0x559bf554426a in erofs_pack_file_from_fd /home/xtex/src/erofs/erofs-utils/lib/fragments.c:302:7
    #3 0x559bf552e89f in erofs_write_compress_dir /home/xtex/src/erofs/erofs-utils/lib/compress.c:2074:8
    #4 0x559bf5507421 in erofs_write_dir_file /home/xtex/src/erofs/erofs-utils/lib/inode.c:744:9
    #5 0x559bf5507421 in erofs_mkfs_jobfn /home/xtex/src/erofs/erofs-utils/lib/inode.c:1654:9
    #6 0x559bf5507421 in z_erofs_mt_dfops_worker /home/xtex/src/erofs/erofs-utils/lib/inode.c:1723:9
    #7 0x559bf5498fca in asan_thread_start(void*) asan_interceptors.cpp.o

Indirect leak of 7135 byte(s) in 127 object(s) allocated from:
    #0 0x559bf549b788 in malloc (/home/xtex/src/erofs/erofs-utils/mkfs/mkfs.erofs+0x10f788)
    #1 0x559bf55439c5 in erofs_fragment_pack /home/xtex/src/erofs/erofs-utils/lib/fragments.c:218:13
    #2 0x559bf554426a in erofs_pack_file_from_fd /home/xtex/src/erofs/erofs-utils/lib/fragments.c:302:7
    #3 0x559bf552e89f in erofs_write_compress_dir /home/xtex/src/erofs/erofs-utils/lib/compress.c:2074:8
    #4 0x559bf5507421 in erofs_write_dir_file /home/xtex/src/erofs/erofs-utils/lib/inode.c:744:9
    #5 0x559bf5507421 in erofs_mkfs_jobfn /home/xtex/src/erofs/erofs-utils/lib/inode.c:1654:9
    #6 0x559bf5507421 in z_erofs_mt_dfops_worker /home/xtex/src/erofs/erofs-utils/lib/inode.c:1723:9
    #7 0x559bf5498fca in asan_thread_start(void*) asan_interceptors.cpp.o
---
 lib/fragments.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/fragments.c b/lib/fragments.c
index 13afce3be537..f137e41b7365 100644
--- a/lib/fragments.c
+++ b/lib/fragments.c
@@ -325,6 +325,10 @@ int erofs_fragment_commit(struct erofs_inode *inode, u32 tofh)
 
 	if (fi->pos) {
 		inode->fragmentoff = fi->pos - len;
+		if (list_empty(&fi->list)) {
+			free(fi->data);
+			free(fi);
+		}
 		return 0;
 	}
 

---
base-commit: 30711d4b2e234fe3e8aaeb779ade4cb609b0d920
change-id: 20260706-fix-frag-leak-f7a6cf172168

Best regards,
--  
Bingwu Zhang <xtex@astrafall.org>