Skip to contentSkip to conversation

ext4: fix memory leak in ext4_ext_insert_extent

PATCH In review Shen Feng 2 participants 2 messages Jun 19, 2008 ext4 file system

lore
Share & tools
lore

Shen Feng

author
#0 lore raw

PATCH 1/1 ext4: fix memory leak in ext4_ext_insert_extent

In ext4_ext_insert_extent, when path is assigned by npath, there is a memory leak and then path points to a freed memory after the function returns becasue npath and path point to the same memory address and npath is freed.

Signed-off-by Shen Feng <[email protected]>
---
 fs/ext4/extents.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
fs/ext4/extents.c +3 -1
index 3f6be32..71a56f1 100644
@@ -1497,6 +1497,8 @@ repeat:
 		if (le16_to_cpu(eh->eh_entries) < le16_to_cpu(eh->eh_max)) {
 			ext_debug("next leaf isnt full(%d)\n",
 				  le16_to_cpu(eh->eh_entries));
+			ext4_ext_drop_refs(path);
+			kfree(path);
 			path = npath;
 			goto repeat;
 		}

@@ -1578,7 +1580,7 @@ merge:
 	err = ext4_ext_dirty(handle, inode, path + depth);
 
 cleanup:
-	if (npath) {
+	if (npath && npath != path) {
 		ext4_ext_drop_refs(npath);
 		kfree(npath);
 	}
Signature · 1 line
1.5.5.1
#1 lore raw
Quoted 6 lines · Shen Feng

In ext4_ext_insert_extent, when path is assigned by npath, there is a memory leak and then path points to a freed memory after the function returns becasue npath and path point to the same memory address and npath is freed.

NACK. The refs are dropped and path freed in the caller. For example look at ext4_ext_get_blocks we drop the path reference at

2741 out2:
2742 if (path) {
2743 ext4_ext_drop_refs(path);
2744 kfree(path);
2745 }

in ext4_ext_insert_extent we use npath as a local variable and is freed toward the end.

Quoted 30 lines
Signed-off-by Shen Feng <[email protected]>
---
 fs/ext4/extents.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
fs/ext4/extents.c +3 -1
index 3f6be32..71a56f1 100644
@@ -1497,6 +1497,8 @@ repeat:
 		if (le16_to_cpu(eh->eh_entries) < le16_to_cpu(eh->eh_max)) {
 			ext_debug("next leaf isnt full(%d)\n",
 				  le16_to_cpu(eh->eh_entries));
+			ext4_ext_drop_refs(path);
+			kfree(path);
 			path = npath;
 			goto repeat;
 		}

@@ -1578,7 +1580,7 @@ merge:
 	err = ext4_ext_dirty(handle, inode, path + depth);
 
 cleanup:
-	if (npath) {
+	if (npath && npath != path) {
 		ext4_ext_drop_refs(npath);
 		kfree(npath);
 	}
Signature · 1 line
1.5.5.1