diff options
| author | Wenwen Wang <wenwen@cs.uga.edu> | 2019-08-19 23:55:04 +0200 |
|---|---|---|
| committer | Richard Weinberger <richard@nod.at> | 2019-09-15 22:42:41 +0200 |
| commit | 6a379f67454a3c740671ed6c7793b76ffecef50b (patch) | |
| tree | 14307fd46d3435e8fb8164fad591f5f4f9dea740 /fs/jffs2/scan.c | |
| parent | jffs2: Remove jffs2_gc_fetch_page and jffs2_gc_release_page (diff) | |
| download | linux-6a379f67454a3c740671ed6c7793b76ffecef50b.tar.xz linux-6a379f67454a3c740671ed6c7793b76ffecef50b.zip | |
jffs2: Fix memory leak in jffs2_scan_eraseblock() error path
In jffs2_scan_eraseblock(), 'sumptr' is allocated through kmalloc() if
'sumlen' is larger than 'buf_size'. However, it is not deallocated in the
following execution if jffs2_fill_scan_buf() fails, leading to a memory
leak bug. To fix this issue, free 'sumptr' before returning the error.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Signed-off-by: Richard Weinberger <richard@nod.at>
Diffstat (limited to 'fs/jffs2/scan.c')
| -rw-r--r-- | fs/jffs2/scan.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c index 90431dd613b8..5f7e284e0df3 100644 --- a/fs/jffs2/scan.c +++ b/fs/jffs2/scan.c @@ -527,8 +527,11 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo err = jffs2_fill_scan_buf(c, sumptr, jeb->offset + c->sector_size - sumlen, sumlen - buf_len); - if (err) + if (err) { + if (sumlen > buf_size) + kfree(sumptr); return err; + } } } |