56 lines
1.9 KiB
Diff
56 lines
1.9 KiB
Diff
From ef787512b2a3a79de6aac63c9b715cd8791594e5 Mon Sep 17 00:00:00 2001
|
|
From: Phillip Lougher <phillip@squashfs.org.uk>
|
|
Date: Mon, 11 Aug 2025 23:37:40 +0100
|
|
Subject: squashfs: fix memory leak in squashfs_fill_super
|
|
|
|
If sb_min_blocksize returns 0, squashfs_fill_super exits without freeing
|
|
allocated memory (sb->s_fs_info).
|
|
|
|
Fix this by moving the call to sb_min_blocksize to before memory is
|
|
allocated.
|
|
|
|
Link: https://lkml.kernel.org/r/20250811223740.110392-1-phillip@squashfs.org.uk
|
|
Fixes: 734aa85390ea ("Squashfs: check return result of sb_min_blocksize")
|
|
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
|
|
Reported-by: Scott GUO <scottzhguo@tencent.com>
|
|
Closes: https://lore.kernel.org/all/20250811061921.3807353-1-scott_gzh@163.com
|
|
Cc: <stable@vger.kernel.org>
|
|
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
---
|
|
fs/squashfs/super.c | 14 +++++++-------
|
|
1 file changed, 7 insertions(+), 7 deletions(-)
|
|
|
|
--- a/fs/squashfs/super.c
|
|
+++ b/fs/squashfs/super.c
|
|
@@ -187,10 +187,15 @@ static int squashfs_fill_super(struct su
|
|
unsigned short flags;
|
|
unsigned int fragments;
|
|
u64 lookup_table_start, xattr_id_table_start, next_table;
|
|
- int err;
|
|
+ int err, devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);
|
|
|
|
TRACE("Entered squashfs_fill_superblock\n");
|
|
|
|
+ if (!devblksize) {
|
|
+ errorf(fc, "squashfs: unable to set blocksize\n");
|
|
+ return -EINVAL;
|
|
+ }
|
|
+
|
|
sb->s_fs_info = kzalloc(sizeof(*msblk), GFP_KERNEL);
|
|
if (sb->s_fs_info == NULL) {
|
|
ERROR("Failed to allocate squashfs_sb_info\n");
|
|
@@ -201,12 +206,7 @@ static int squashfs_fill_super(struct su
|
|
|
|
msblk->panic_on_errors = (opts->errors == Opt_errors_panic);
|
|
|
|
- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);
|
|
- if (!msblk->devblksize) {
|
|
- errorf(fc, "squashfs: unable to set blocksize\n");
|
|
- return -EINVAL;
|
|
- }
|
|
-
|
|
+ msblk->devblksize = devblksize;
|
|
msblk->devblksize_log2 = ffz(~msblk->devblksize);
|
|
|
|
mutex_init(&msblk->meta_index_mutex);
|