Hello,
attached patch should fix this. I'll queue it to my tree.
Honza
On Tue 22-12-20 02:24:18, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 8653b778 Merge tag 'clk-for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=153fc4db500000
> kernel config: https://syzkaller.appspot.com/x/.config?x=faf2996955887e91
> dashboard link: https://syzkaller.appspot.com/bug?extid=77779c9b52ab78154b08
> compiler: gcc (GCC) 10.1.0-syz 20200507
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c44960d00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13bc8c0b500000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+77779c9b52ab78154...@syzkaller.appspotmail.com
>
> BUG: memory leak
> unreferenced object 0xffff888110974f00 (size 64):
> comm "syz-executor849", pid 8516, jiffies 4294942501 (age 13.960s)
> hex dump (first 32 bytes):
> 00 30 ee 0d 81 88 ff ff 00 00 00 00 00 00 00 00 .0..............
> 00 00 00 00 00 00 00 00 0a 00 00 00 48 00 00 00 ............H...
> backtrace:
> [<0000000018aa1939>] kmalloc include/linux/slab.h:552 [inline]
> [<0000000018aa1939>] v2_read_file_info+0x1ae/0x430 fs/quota/quota_v2.c:122
> [<000000001061252b>] dquot_load_quota_sb+0x351/0x650 fs/quota/dquot.c:2387
> [<000000006c1f70f9>] dquot_load_quota_inode fs/quota/dquot.c:2423 [inline]
> [<000000006c1f70f9>] dquot_load_quota_inode+0xda/0x160
> fs/quota/dquot.c:2415
> [<00000000abace495>] ext4_quota_enable fs/ext4/super.c:6362 [inline]
> [<00000000abace495>] ext4_enable_quotas+0x1b2/0x2f0 fs/ext4/super.c:6388
> [<00000000b6d6a975>] ext4_fill_super+0x3bc5/0x5ac0 fs/ext4/super.c:5046
> [<0000000003a869bd>] mount_bdev+0x223/0x260 fs/super.c:1366
> [<000000002138e18c>] legacy_get_tree+0x2b/0x90 fs/fs_context.c:592
> [<0000000096e90d3d>] vfs_get_tree+0x28/0x100 fs/super.c:1496
> [<00000000eddeeb8e>] do_new_mount fs/namespace.c:2875 [inline]
> [<00000000eddeeb8e>] path_mount+0xc5e/0x1170 fs/namespace.c:3205
> [<00000000c52e2f18>] do_mount fs/namespace.c:3218 [inline]
> [<00000000c52e2f18>] __do_sys_mount fs/namespace.c:3426 [inline]
> [<00000000c52e2f18>] __se_sys_mount fs/namespace.c:3403 [inline]
> [<00000000c52e2f18>] __x64_sys_mount+0x18e/0x1d0 fs/namespace.c:3403
> [<00000000e70a31f4>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> [<000000007f651b8c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkal...@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> syzbot can test patches for this issue, for details see:
> https://goo.gl/tpsmEJ#testing-patches
>
--
Jan Kara <j...@suse.com>
SUSE Labs, CR
>From 4d76181dc109d8a0c8ce74325ee5e885734d5ab8 Mon Sep 17 00:00:00 2001
From: Jan Kara <j...@suse.cz>
Date: Tue, 22 Dec 2020 12:09:53 +0100
Subject: [PATCH] quota: Fix memory leak when handling corrupted quota file
When checking corrupted quota file we can bail out and leak allocated
info structure. Properly free info structure on error return.
Reported-by: syzbot+77779c9b52ab78154...@syzkaller.appspotmail.com
Fixes: 11c514a99bb9 ("quota: Sanity-check quota file headers on load")
Signed-off-by: Jan Kara <j...@suse.cz>
---
fs/quota/quota_v2.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
index c21106557a37..b1467f3921c2 100644
--- a/fs/quota/quota_v2.c
+++ b/fs/quota/quota_v2.c
@@ -164,19 +164,24 @@ static int v2_read_file_info(struct super_block *sb, int type)
quota_error(sb, "Number of blocks too big for quota file size (%llu > %llu).",
(loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits,
i_size_read(sb_dqopt(sb)->files[type]));
- goto out;
+ goto out_free;
}
if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) {
quota_error(sb, "Free block number too big (%u >= %u).",
qinfo->dqi_free_blk, qinfo->dqi_blocks);
- goto out;
+ goto out_free;
}
if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) {
quota_error(sb, "Block with free entry too big (%u >= %u).",
qinfo->dqi_free_entry, qinfo->dqi_blocks);
- goto out;
+ goto out_free;
}
ret = 0;
+out_free:
+ if (ret) {
+ kfree(info->dqi_priv);
+ info->dqi_priv = NULL;
+ }
out:
up_read(&dqopt->dqio_sem);
return ret;
--
2.16.4
