Patch "btrfs: fix possible leak in btrfs_ioctl_balance()" has been added to the 4.2-stable tree

This is a note to let you know that I've just added the patch titled

btrfs: fix possible leak in btrfs_ioctl_balance()

to the 4.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch
and it can be found in the queue-4.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Christian Engelmayer <[email protected]>
Date: Wed, 21 Oct 2015 00:50:06 +0200
Subject: btrfs: fix possible leak in btrfs_ioctl_balance()

From: Christian Engelmayer <[email protected]>

commit 0f89abf56abbd0e1c6e3cef9813e6d9f05383c1e upstream.

Commit 8eb934591f8b ("btrfs: check unsupported filters in balance arguments") adds a jump to exit label out_bargs in case the argument check fails. At this point in addition to the bargs memory, the memory for struct btrfs_balance_control has already been allocated. Ownership of bctl is passed to btrfs_balance() in the good case, thus the memory is not freed due to the introduced jump. Make sure that the memory gets freed in any case as necessary. Detected by Coverity CID 1328378.

---
 fs/btrfs/ioctl.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

@@ -4649,7 +4649,7 @@ locked:
 
 	if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) {
 		ret = -EINVAL;
-		goto out_bargs;
+		goto out_bctl;
 	}
 
 do_balance:

@@ -4663,12 +4663,15 @@ do_balance:
 	need_unlock = false;
 
 	ret = btrfs_balance(bctl, bargs);
+	bctl = NULL;
 
 	if (arg) {
 		if (copy_to_user(arg, bargs, sizeof(*bargs)))
 			ret = -EFAULT;
 	}
 
+out_bctl:
+	kfree(bctl);
 out_bargs:
 	kfree(bargs);
 out_unlock:

Patches currently in stable-queue which might be from [email protected] are

queue-4.2/btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch