From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Dave Jones <davej@fedoraproject.org>,
"Theodore Tso" <tytso@mit.edu>, Eric Sandeen <sandeen@redhat.com>
Subject: [ 10/50] ext4: fix memory leak in xattr
Date: Wed, 16 Oct 2013 10:44:56 -0700 [thread overview]
Message-ID: <20131016174359.643248978@linuxfoundation.org> (raw)
In-Reply-To: <20131016174358.335646140@linuxfoundation.org>
3.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jones <davej@redhat.com>
commit 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc upstream.
If we take the 2nd retry path in ext4_expand_extra_isize_ea, we
potentionally return from the function without having freed these
allocations. If we don't do the return, we over-write the previous
allocation pointers, so we leak either way.
Spotted with Coverity.
[ Fixed by tytso to set is and bs to NULL after freeing these
pointers, in case in the retry loop we later end up triggering an
error causing a jump to cleanup, at which point we could have a double
free bug. -- Ted ]
Signed-off-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/xattr.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1350,6 +1350,8 @@ retry:
s_min_extra_isize) {
tried_min_extra_isize++;
new_extra_isize = s_min_extra_isize;
+ kfree(is); is = NULL;
+ kfree(bs); bs = NULL;
goto retry;
}
error = -1;
next prev parent reply other threads:[~2013-10-16 17:44 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-16 17:44 [ 00/50] 3.11.6-stable review Greg Kroah-Hartman
2013-10-16 17:44 ` [ 01/50] ALSA: snd-usb-usx2y: remove bogus frame checks Greg Kroah-Hartman
2013-10-16 17:44 ` [ 02/50] ALSA: hda - hdmi: Fix channel map switch not taking effect Greg Kroah-Hartman
2013-10-16 17:44 ` [ 03/50] ALSA: hda - Add fixup for ASUS N56VZ Greg Kroah-Hartman
2013-10-16 17:44 ` [ 04/50] ALSA: hda - Fix microphone for Sony VAIO Pro 13 (Haswell model) Greg Kroah-Hartman
2013-10-16 17:44 ` [ 05/50] random: run random_int_secret_init() run after all late_initcalls Greg Kroah-Hartman
2013-10-16 17:44 ` [ 06/50] vfs: allow O_PATH file descriptors for fstatfs() Greg Kroah-Hartman
2013-10-16 17:44 ` [ 07/50] i2c: omap: Clear ARDY bit twice Greg Kroah-Hartman
2013-10-16 17:44 ` [ 08/50] hwmon: (applesmc) Always read until end of data Greg Kroah-Hartman
2013-10-16 17:44 ` [ 09/50] Btrfs: use right root when checking for hash collision Greg Kroah-Hartman
2013-10-16 17:44 ` Greg Kroah-Hartman [this message]
2013-10-16 17:44 ` [ 11/50] KVM: PPC: Book3S HV: Fix typo in saving DSCR Greg Kroah-Hartman
2013-10-16 17:44 ` [ 12/50] parisc: fix interruption handler to respect pagefault_disable() Greg Kroah-Hartman
2013-10-16 17:44 ` [ 13/50] ARC: Fix __udelay calculation Greg Kroah-Hartman
2013-10-16 17:45 ` [ 14/50] ARC: Handle zero-overhead-loop in unaligned access handler Greg Kroah-Hartman
2013-10-16 17:45 ` [ 15/50] ARC: Fix 32-bit wrap around in access_ok() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 16/50] ARC: Workaround spinlock livelock in SMP SystemC simulation Greg Kroah-Hartman
2013-10-16 17:45 ` [ 17/50] ARC: Fix signal frame management for SA_SIGINFO Greg Kroah-Hartman
2013-10-16 17:45 ` [ 18/50] ARC: Ignore ptrace SETREGSET request for synthetic register "stop_pc" Greg Kroah-Hartman
2013-10-16 17:45 ` [ 19/50] watchdog: ts72xx_wdt: locking bug in ioctl Greg Kroah-Hartman
2013-10-16 17:45 ` [ 20/50] watchdog: kempld_wdt: Fix bit mask definition Greg Kroah-Hartman
2013-10-16 17:45 ` [ 21/50] MIPS: stack protector: Fix per-task canary switch Greg Kroah-Hartman
2013-10-16 17:45 ` [ 22/50] drm/radeon/dpm/btc: off by one in btc_set_mc_special_registers() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 23/50] compiler/gcc4: Add quirk for asm goto miscompilation bug Greg Kroah-Hartman
2013-10-16 17:45 ` [ 24/50] ALSA: hda - Fix mono speakers and headset mic on Dell Vostro 5470 Greg Kroah-Hartman
2013-10-16 17:45 ` [ 25/50] drm/i915/hsw: Disable L3 caching of atomic memory operations Greg Kroah-Hartman
2013-10-16 17:45 ` [ 26/50] drm/i915: Only apply DPMS to the encoder if enabled Greg Kroah-Hartman
2013-10-16 17:45 ` [ 27/50] drm/i915: fix rps.vlv_work initialization Greg Kroah-Hartman
2013-10-16 17:45 ` [ 28/50] drm/radeon/dpm: off by one in si_set_mc_special_registers() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 29/50] drm/radeon: forever loop on error in radeon_do_test_moves() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 30/50] drm/radeon: fix typo in CP DMA register headers Greg Kroah-Hartman
2013-10-16 17:45 ` [ 31/50] drm/radeon: fix hw contexts for SUMO2 asics Greg Kroah-Hartman
2013-10-16 17:45 ` [ 32/50] ipc,shm: introduce lockless functions to obtain the ipc object Greg Kroah-Hartman
2013-10-16 17:45 ` [ 33/50] ipc,shm: shorten critical region in shmctl_down Greg Kroah-Hartman
2013-10-16 17:45 ` [ 34/50] ipc: drop ipcctl_pre_down Greg Kroah-Hartman
2013-10-16 17:45 ` [ 35/50] ipc,shm: introduce shmctl_nolock Greg Kroah-Hartman
2013-10-16 17:45 ` [ 36/50] ipc,shm: make shmctl_nolock lockless Greg Kroah-Hartman
2013-10-16 17:45 ` [ 37/50] ipc,shm: shorten critical region for shmctl Greg Kroah-Hartman
2013-10-16 17:45 ` [ 38/50] ipc,shm: cleanup do_shmat pasta Greg Kroah-Hartman
2013-10-16 17:45 ` [ 39/50] ipc,shm: shorten critical region for shmat Greg Kroah-Hartman
2013-10-16 17:45 ` [ 40/50] ipc: rename ids->rw_mutex Greg Kroah-Hartman
2013-10-16 17:45 ` [ 41/50] ipc,msg: drop msg_unlock Greg Kroah-Hartman
2013-10-16 17:45 ` [ 42/50] ipc: document general ipc locking scheme Greg Kroah-Hartman
2013-10-16 17:45 ` [ 43/50] ipc, shm: guard against non-existant vma in shmdt(2) Greg Kroah-Hartman
2013-10-16 17:45 ` [ 44/50] ipc: drop ipc_lock_by_ptr Greg Kroah-Hartman
2013-10-16 17:45 ` [ 45/50] ipc, shm: drop shm_lock_check Greg Kroah-Hartman
2013-10-16 17:45 ` [ 46/50] ipc: drop ipc_lock_check Greg Kroah-Hartman
2013-10-16 17:45 ` [ 47/50] ipc/sem.c: optimize sem_lock() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 48/50] ipc/sem.c: synchronize the proc interface Greg Kroah-Hartman
2013-10-16 17:45 ` [ 49/50] ipc/sem.c: update sem_otime for all operations Greg Kroah-Hartman
2013-10-16 17:45 ` [ 50/50] x86: avoid remapping data in parse_setup_data() Greg Kroah-Hartman
2013-10-16 22:14 ` [ 00/50] 3.11.6-stable review Guenter Roeck
2013-10-17 1:07 ` Greg Kroah-Hartman
2013-10-17 16:52 ` Shuah Khan
2013-10-17 17:08 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131016174359.643248978@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davej@fedoraproject.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sandeen@redhat.com \
--cc=stable@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).