stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Dave Jones <davej@fedoraproject.org>,
	"Theodore Tso" <tytso@mit.edu>, Eric Sandeen <sandeen@redhat.com>
Subject: [ 10/50] ext4: fix memory leak in xattr
Date: Wed, 16 Oct 2013 10:44:56 -0700	[thread overview]
Message-ID: <20131016174359.643248978@linuxfoundation.org> (raw)
In-Reply-To: <20131016174358.335646140@linuxfoundation.org>

3.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Jones <davej@redhat.com>

commit 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc upstream.

If we take the 2nd retry path in ext4_expand_extra_isize_ea, we
potentionally return from the function without having freed these
allocations.  If we don't do the return, we over-write the previous
allocation pointers, so we leak either way.

Spotted with Coverity.

[ Fixed by tytso to set is and bs to NULL after freeing these
  pointers, in case in the retry loop we later end up triggering an
  error causing a jump to cleanup, at which point we could have a double
  free bug. -- Ted ]

Signed-off-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/xattr.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1350,6 +1350,8 @@ retry:
 				    s_min_extra_isize) {
 					tried_min_extra_isize++;
 					new_extra_isize = s_min_extra_isize;
+					kfree(is); is = NULL;
+					kfree(bs); bs = NULL;
 					goto retry;
 				}
 				error = -1;



  parent reply	other threads:[~2013-10-16 17:44 UTC|newest]

Thread overview: 55+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-10-16 17:44 [ 00/50] 3.11.6-stable review Greg Kroah-Hartman
2013-10-16 17:44 ` [ 01/50] ALSA: snd-usb-usx2y: remove bogus frame checks Greg Kroah-Hartman
2013-10-16 17:44 ` [ 02/50] ALSA: hda - hdmi: Fix channel map switch not taking effect Greg Kroah-Hartman
2013-10-16 17:44 ` [ 03/50] ALSA: hda - Add fixup for ASUS N56VZ Greg Kroah-Hartman
2013-10-16 17:44 ` [ 04/50] ALSA: hda - Fix microphone for Sony VAIO Pro 13 (Haswell model) Greg Kroah-Hartman
2013-10-16 17:44 ` [ 05/50] random: run random_int_secret_init() run after all late_initcalls Greg Kroah-Hartman
2013-10-16 17:44 ` [ 06/50] vfs: allow O_PATH file descriptors for fstatfs() Greg Kroah-Hartman
2013-10-16 17:44 ` [ 07/50] i2c: omap: Clear ARDY bit twice Greg Kroah-Hartman
2013-10-16 17:44 ` [ 08/50] hwmon: (applesmc) Always read until end of data Greg Kroah-Hartman
2013-10-16 17:44 ` [ 09/50] Btrfs: use right root when checking for hash collision Greg Kroah-Hartman
2013-10-16 17:44 ` Greg Kroah-Hartman [this message]
2013-10-16 17:44 ` [ 11/50] KVM: PPC: Book3S HV: Fix typo in saving DSCR Greg Kroah-Hartman
2013-10-16 17:44 ` [ 12/50] parisc: fix interruption handler to respect pagefault_disable() Greg Kroah-Hartman
2013-10-16 17:44 ` [ 13/50] ARC: Fix __udelay calculation Greg Kroah-Hartman
2013-10-16 17:45 ` [ 14/50] ARC: Handle zero-overhead-loop in unaligned access handler Greg Kroah-Hartman
2013-10-16 17:45 ` [ 15/50] ARC: Fix 32-bit wrap around in access_ok() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 16/50] ARC: Workaround spinlock livelock in SMP SystemC simulation Greg Kroah-Hartman
2013-10-16 17:45 ` [ 17/50] ARC: Fix signal frame management for SA_SIGINFO Greg Kroah-Hartman
2013-10-16 17:45 ` [ 18/50] ARC: Ignore ptrace SETREGSET request for synthetic register "stop_pc" Greg Kroah-Hartman
2013-10-16 17:45 ` [ 19/50] watchdog: ts72xx_wdt: locking bug in ioctl Greg Kroah-Hartman
2013-10-16 17:45 ` [ 20/50] watchdog: kempld_wdt: Fix bit mask definition Greg Kroah-Hartman
2013-10-16 17:45 ` [ 21/50] MIPS: stack protector: Fix per-task canary switch Greg Kroah-Hartman
2013-10-16 17:45 ` [ 22/50] drm/radeon/dpm/btc: off by one in btc_set_mc_special_registers() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 23/50] compiler/gcc4: Add quirk for asm goto miscompilation bug Greg Kroah-Hartman
2013-10-16 17:45 ` [ 24/50] ALSA: hda - Fix mono speakers and headset mic on Dell Vostro 5470 Greg Kroah-Hartman
2013-10-16 17:45 ` [ 25/50] drm/i915/hsw: Disable L3 caching of atomic memory operations Greg Kroah-Hartman
2013-10-16 17:45 ` [ 26/50] drm/i915: Only apply DPMS to the encoder if enabled Greg Kroah-Hartman
2013-10-16 17:45 ` [ 27/50] drm/i915: fix rps.vlv_work initialization Greg Kroah-Hartman
2013-10-16 17:45 ` [ 28/50] drm/radeon/dpm: off by one in si_set_mc_special_registers() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 29/50] drm/radeon: forever loop on error in radeon_do_test_moves() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 30/50] drm/radeon: fix typo in CP DMA register headers Greg Kroah-Hartman
2013-10-16 17:45 ` [ 31/50] drm/radeon: fix hw contexts for SUMO2 asics Greg Kroah-Hartman
2013-10-16 17:45 ` [ 32/50] ipc,shm: introduce lockless functions to obtain the ipc object Greg Kroah-Hartman
2013-10-16 17:45 ` [ 33/50] ipc,shm: shorten critical region in shmctl_down Greg Kroah-Hartman
2013-10-16 17:45 ` [ 34/50] ipc: drop ipcctl_pre_down Greg Kroah-Hartman
2013-10-16 17:45 ` [ 35/50] ipc,shm: introduce shmctl_nolock Greg Kroah-Hartman
2013-10-16 17:45 ` [ 36/50] ipc,shm: make shmctl_nolock lockless Greg Kroah-Hartman
2013-10-16 17:45 ` [ 37/50] ipc,shm: shorten critical region for shmctl Greg Kroah-Hartman
2013-10-16 17:45 ` [ 38/50] ipc,shm: cleanup do_shmat pasta Greg Kroah-Hartman
2013-10-16 17:45 ` [ 39/50] ipc,shm: shorten critical region for shmat Greg Kroah-Hartman
2013-10-16 17:45 ` [ 40/50] ipc: rename ids->rw_mutex Greg Kroah-Hartman
2013-10-16 17:45 ` [ 41/50] ipc,msg: drop msg_unlock Greg Kroah-Hartman
2013-10-16 17:45 ` [ 42/50] ipc: document general ipc locking scheme Greg Kroah-Hartman
2013-10-16 17:45 ` [ 43/50] ipc, shm: guard against non-existant vma in shmdt(2) Greg Kroah-Hartman
2013-10-16 17:45 ` [ 44/50] ipc: drop ipc_lock_by_ptr Greg Kroah-Hartman
2013-10-16 17:45 ` [ 45/50] ipc, shm: drop shm_lock_check Greg Kroah-Hartman
2013-10-16 17:45 ` [ 46/50] ipc: drop ipc_lock_check Greg Kroah-Hartman
2013-10-16 17:45 ` [ 47/50] ipc/sem.c: optimize sem_lock() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 48/50] ipc/sem.c: synchronize the proc interface Greg Kroah-Hartman
2013-10-16 17:45 ` [ 49/50] ipc/sem.c: update sem_otime for all operations Greg Kroah-Hartman
2013-10-16 17:45 ` [ 50/50] x86: avoid remapping data in parse_setup_data() Greg Kroah-Hartman
2013-10-16 22:14 ` [ 00/50] 3.11.6-stable review Guenter Roeck
2013-10-17  1:07   ` Greg Kroah-Hartman
2013-10-17 16:52 ` Shuah Khan
2013-10-17 17:08   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20131016174359.643248978@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davej@fedoraproject.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sandeen@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).