diff options
| author | Colin Ian King <colin.king@canonical.com> | 2019-07-05 08:26:24 +0100 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2019-07-05 18:47:57 +0200 |
| commit | e02d48eaaed77f6c36916a7aa65c451e1f9d9aab (patch) | |
| tree | 59aec3f4273813834a2259005c104c1ec92ff919 /fs/btrfs | |
| parent | 28a32d2b1a6d7860e0b364c34a6b4205dce85537 (diff) | |
| download | linux-e02d48eaaed77f6c36916a7aa65c451e1f9d9aab.tar.bz2 | |
btrfs: fix memory leak of path on error return path
Currently if the allocation of roots or tmp_ulist fails the error handling
does not free up the allocation of path causing a memory leak. Fix this and
other similar leaks by moving the call of btrfs_free_path from label out
to label out_free_ulist.
Kudos to David Sterba for spotting the issue in my original fix and suggesting
the correct way to fix the leak and Anand Jain for spotting a double free
issue.
Addresses-Coverity: ("Resource leak")
Fixes: 5911c8fe05c5 ("btrfs: fiemap: preallocate ulists for btrfs_check_shared")
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/btrfs')
| -rw-r--r-- | fs/btrfs/extent_io.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c index 6b154bce5687..aea990473392 100644 --- a/fs/btrfs/extent_io.c +++ b/fs/btrfs/extent_io.c @@ -4611,7 +4611,6 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, ret = btrfs_lookup_file_extent(NULL, root, path, btrfs_ino(BTRFS_I(inode)), -1, 0); if (ret < 0) { - btrfs_free_path(path); goto out_free_ulist; } else { WARN_ON(!ret); @@ -4764,11 +4763,11 @@ out_free: ret = emit_last_fiemap_cache(fieinfo, &cache); free_extent_map(em); out: - btrfs_free_path(path); unlock_extent_cached(&BTRFS_I(inode)->io_tree, start, start + len - 1, &cached_state); out_free_ulist: + btrfs_free_path(path); ulist_free(roots); ulist_free(tmp_ulist); return ret; |