From: "Namjae Jeon" <namjae.jeon@samsung.com>
To: "'Al Viro'" <viro@zeniv.linux.org.uk>
Cc: <sj1557.seo@samsung.com>, <linux-fsdevel@vger.kernel.org>,
<linux-kernel@vger.kernel.org>,
"'syzkaller'" <syzkaller@googlegroups.com>,
"'butt3rflyh4ck'" <butterflyhuangxx@gmail.com>
Subject: RE: memory leak in exfat_parse_param
Date: Wed, 3 Jun 2020 10:32:41 +0900 [thread overview]
Message-ID: <014501d63946$df61a260$9e24e720$@samsung.com> (raw)
In-Reply-To: <20200602162808.GK23230@ZenIV.linux.org.uk>
> On Tue, Jun 02, 2020 at 01:03:05PM +0800, butt3rflyh4ck wrote:
> > I report a bug (in linux-5.7.0-rc7) found by syzkaller.
> >
> > kernel config:
> > https://protect2.fireeye.com/url?k=f3a88a7d-ae6446d8-f3a90132-0cc47a30
> > d446-6021a2fbdd1681a8&q=1&u=https%3A%2F%2Fgithub.com%2Fbutterflyhack%2
> > Fsyzkaller-fuzz%2Fblob%2Fmaster%2Fconfig-v5.7.0-rc7
> >
> > and can reproduce.
> >
> > A param->string held by exfat_mount_options.
>
> Humm...
>
> First of all, exfat_free() ought to call exfat_free_upcase_table().
> What's more, WTF bother with that kstrdup(), anyway? Just steal the string and be done with that...
Thanks for your patch. I will push it to exfat tree.
>
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
> ---
> diff --git a/fs/exfat/super.c b/fs/exfat/super.c index 0565d5539d57..01cd7ed1614d 100644
> --- a/fs/exfat/super.c
> +++ b/fs/exfat/super.c
> @@ -259,9 +259,8 @@ static int exfat_parse_param(struct fs_context *fc, struct fs_parameter *param)
> break;
> case Opt_charset:
> exfat_free_iocharset(sbi);
> - opts->iocharset = kstrdup(param->string, GFP_KERNEL);
> - if (!opts->iocharset)
> - return -ENOMEM;
> + opts->iocharset = param->string;
> + param->string = NULL;
> break;
> case Opt_errors:
> opts->errors = result.uint_32;
> @@ -611,7 +610,10 @@ static int exfat_get_tree(struct fs_context *fc)
>
> static void exfat_free(struct fs_context *fc) {
> - kfree(fc->s_fs_info);
> + struct exfat_sb_info *sbi = fc->s_fs_info;
> +
> + exfat_free_iocharset(sbi);
> + kfree(sbi);
> }
>
> static const struct fs_context_operations exfat_context_ops = {
prev parent reply other threads:[~2020-06-03 1:32 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-02 5:03 memory leak in exfat_parse_param butt3rflyh4ck
2020-06-02 16:28 ` Al Viro
2020-06-03 1:32 ` Namjae Jeon [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='014501d63946$df61a260$9e24e720$@samsung.com' \
--to=namjae.jeon@samsung.com \
--cc=butterflyhuangxx@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sj1557.seo@samsung.com \
--cc=syzkaller@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).