0069-zfs-Fix-resource-leaks-while-constructing-path.patch 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122
  1. From 89bdab965805e8d54d7f75349024e1a11cbe2eb8 Mon Sep 17 00:00:00 2001
  2. From: Paulo Flabiano Smorigo <pfsmorigo@canonical.com>
  3. Date: Mon, 14 Dec 2020 18:54:49 -0300
  4. Subject: [PATCH] zfs: Fix resource leaks while constructing path
  5. There are several exit points in dnode_get_path() that are causing possible
  6. memory leaks.
  7. In the while(1) the correct exit mechanism should not be to do a direct return,
  8. but to instead break out of the loop, setting err first if it is not already set.
  9. The reason behind this is that the dnode_path is a linked list, and while doing
  10. through this loop, it is being allocated and built up - the only way to
  11. correctly unravel it is to traverse it, which is what is being done at the end
  12. of the function outside of the loop.
  13. Several of the existing exit points correctly did a break, but not all so this
  14. change makes that more consistent and should resolve the leaking of memory as
  15. found by Coverity.
  16. Fixes: CID 73741
  17. Signed-off-by: Paulo Flabiano Smorigo <pfsmorigo@canonical.com>
  18. Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
  19. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  20. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  21. ---
  22. grub-core/fs/zfs/zfs.c | 30 +++++++++++++++++++++---------
  23. 1 file changed, 21 insertions(+), 9 deletions(-)
  24. diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
  25. index 0c42cba..9087a72 100644
  26. --- a/grub-core/fs/zfs/zfs.c
  27. +++ b/grub-core/fs/zfs/zfs.c
  28. @@ -2836,8 +2836,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn,
  29. if (dnode_path->dn.dn.dn_type != DMU_OT_DIRECTORY_CONTENTS)
  30. {
  31. - grub_free (path_buf);
  32. - return grub_error (GRUB_ERR_BAD_FILE_TYPE, N_("not a directory"));
  33. + err = grub_error (GRUB_ERR_BAD_FILE_TYPE, N_("not a directory"));
  34. + break;
  35. }
  36. err = zap_lookup (&(dnode_path->dn), cname, &objnum,
  37. data, subvol->case_insensitive);
  38. @@ -2879,11 +2879,18 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn,
  39. << SPA_MINBLOCKSHIFT);
  40. if (blksz == 0)
  41. - return grub_error(GRUB_ERR_BAD_FS, "0-sized block");
  42. + {
  43. + err = grub_error (GRUB_ERR_BAD_FS, "0-sized block");
  44. + break;
  45. + }
  46. sym_value = grub_malloc (sym_sz);
  47. if (!sym_value)
  48. - return grub_errno;
  49. + {
  50. + err = grub_errno;
  51. + break;
  52. + }
  53. +
  54. for (block = 0; block < (sym_sz + blksz - 1) / blksz; block++)
  55. {
  56. void *t;
  57. @@ -2893,7 +2900,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn,
  58. if (err)
  59. {
  60. grub_free (sym_value);
  61. - return err;
  62. + break;
  63. }
  64. movesize = sym_sz - block * blksz;
  65. @@ -2903,6 +2910,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn,
  66. grub_memcpy (sym_value + block * blksz, t, movesize);
  67. grub_free (t);
  68. }
  69. + if (err)
  70. + break;
  71. free_symval = 1;
  72. }
  73. path = path_buf = grub_malloc (sym_sz + grub_strlen (oldpath) + 1);
  74. @@ -2911,7 +2920,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn,
  75. grub_free (oldpathbuf);
  76. if (free_symval)
  77. grub_free (sym_value);
  78. - return grub_errno;
  79. + err = grub_errno;
  80. + break;
  81. }
  82. grub_memcpy (path, sym_value, sym_sz);
  83. if (free_symval)
  84. @@ -2949,11 +2959,12 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn,
  85. err = zio_read (bp, dnode_path->dn.endian, &sahdrp, NULL, data);
  86. if (err)
  87. - return err;
  88. + break;
  89. }
  90. else
  91. {
  92. - return grub_error (GRUB_ERR_BAD_FS, "filesystem is corrupt");
  93. + err = grub_error (GRUB_ERR_BAD_FS, "filesystem is corrupt");
  94. + break;
  95. }
  96. hdrsize = SA_HDR_SIZE (((sa_hdr_phys_t *) sahdrp));
  97. @@ -2974,7 +2985,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn,
  98. if (!path_buf)
  99. {
  100. grub_free (oldpathbuf);
  101. - return grub_errno;
  102. + err = grub_errno;
  103. + break;
  104. }
  105. grub_memcpy (path, sym_value, sym_sz);
  106. path [sym_sz] = 0;
  107. --
  108. 2.14.2