ubifs: dirty_cow_znode: Fix memleak in error handling path

Following process will cause a memleak for copied up znode:

dirty_cow_znode
  zn = copy_znode(c, znode);
  err = insert_old_idx(c, zbr->lnum, zbr->offs);
  if (unlikely(err))
     return ERR_PTR(err);   // No one refers to zn.

Fix it by adding copied znode back to tnc, then it will be freed
by ubifs_destroy_tnc_subtree() while closing tnc.

Fetch a reproducer in [Link].

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216705
Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index 2df56bb..2469f72 100644 (file)
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -267,11 +267,18 @@ static struct ubifs_znode *dirty_cow_znode(struct ubifs_info *c,
        if (zbr->len) {
                err = insert_old_idx(c, zbr->lnum, zbr->offs);
                if (unlikely(err))
-                       return ERR_PTR(err);
+                       /*
+                        * Obsolete znodes will be freed by tnc_destroy_cnext()
+                        * or free_obsolete_znodes(), copied up znodes should
+                        * be added back to tnc and freed by
+                        * ubifs_destroy_tnc_subtree().
+                        */
+                       goto out;
                err = add_idx_dirt(c, zbr->lnum, zbr->len);
        } else
                err = 0;
 
+out:
        zbr->znode = zn;
        zbr->lnum = 0;
        zbr->offs = 0;