| From bfe7a860055dfaba282b49cd803b448ab4e7e5eb Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 12 Apr 2022 17:38:16 +0800 |
| Subject: jffs2: fix memory leak in jffs2_do_fill_super |
| |
| From: Baokun Li <libaokun1@huawei.com> |
| |
| [ Upstream commit c14adb1cf70a984ed081c67e9d27bc3caad9537c ] |
| |
| If jffs2_iget() or d_make_root() in jffs2_do_fill_super() returns |
| an error, we can observe the following kmemleak report: |
| |
| -------------------------------------------- |
| unreferenced object 0xffff888105a65340 (size 64): |
| comm "mount", pid 710, jiffies 4302851558 (age 58.239s) |
| hex dump (first 32 bytes): |
| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ |
| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ |
| backtrace: |
| [<ffffffff859c45e5>] kmem_cache_alloc_trace+0x475/0x8a0 |
| [<ffffffff86160146>] jffs2_sum_init+0x96/0x1a0 |
| [<ffffffff86140e25>] jffs2_do_mount_fs+0x745/0x2120 |
| [<ffffffff86149fec>] jffs2_do_fill_super+0x35c/0x810 |
| [<ffffffff8614aae9>] jffs2_fill_super+0x2b9/0x3b0 |
| [...] |
| unreferenced object 0xffff8881bd7f0000 (size 65536): |
| comm "mount", pid 710, jiffies 4302851558 (age 58.239s) |
| hex dump (first 32 bytes): |
| bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ |
| bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ |
| backtrace: |
| [<ffffffff858579ba>] kmalloc_order+0xda/0x110 |
| [<ffffffff85857a11>] kmalloc_order_trace+0x21/0x130 |
| [<ffffffff859c2ed1>] __kmalloc+0x711/0x8a0 |
| [<ffffffff86160189>] jffs2_sum_init+0xd9/0x1a0 |
| [<ffffffff86140e25>] jffs2_do_mount_fs+0x745/0x2120 |
| [<ffffffff86149fec>] jffs2_do_fill_super+0x35c/0x810 |
| [<ffffffff8614aae9>] jffs2_fill_super+0x2b9/0x3b0 |
| [...] |
| -------------------------------------------- |
| |
| This is because the resources allocated in jffs2_sum_init() are not |
| released. Call jffs2_sum_exit() to release these resources to solve |
| the problem. |
| |
| Fixes: e631ddba5887 ("[JFFS2] Add erase block summary support (mount time improvement)") |
| Signed-off-by: Baokun Li <libaokun1@huawei.com> |
| Signed-off-by: Richard Weinberger <richard@nod.at> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| fs/jffs2/fs.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c |
| index d3c9e4c82e57..610e11e76f2d 100644 |
| --- a/fs/jffs2/fs.c |
| +++ b/fs/jffs2/fs.c |
| @@ -597,6 +597,7 @@ int jffs2_do_fill_super(struct super_block *sb, void *data, int silent) |
| jffs2_free_raw_node_refs(c); |
| kvfree(c->blocks); |
| jffs2_clear_xattr_subsystem(c); |
| + jffs2_sum_exit(c); |
| out_inohash: |
| kfree(c->inocache_list); |
| out_wbuf: |
| -- |
| 2.35.1 |
| |