Skip to content

Commit b64700d

Browse files
plougherakpm00
authored andcommitted
squashfs: fix memory leak in squashfs_fill_super
If sb_min_blocksize returns 0, squashfs_fill_super exits without freeing allocated memory (sb->s_fs_info). Fix this by moving the call to sb_min_blocksize to before memory is allocated. Link: https://lkml.kernel.org/r/[email protected] Fixes: 734aa85 ("Squashfs: check return result of sb_min_blocksize") Signed-off-by: Phillip Lougher <[email protected]> Reported-by: Scott GUO <[email protected]> Closes: https://lore.kernel.org/all/[email protected] Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]>
1 parent 44958f2 commit b64700d

File tree

1 file changed

+7
-7
lines changed

1 file changed

+7
-7
lines changed

fs/squashfs/super.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -187,10 +187,15 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc)
187187
unsigned short flags;
188188
unsigned int fragments;
189189
u64 lookup_table_start, xattr_id_table_start, next_table;
190-
int err;
190+
int err, devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);
191191

192192
TRACE("Entered squashfs_fill_superblock\n");
193193

194+
if (!devblksize) {
195+
errorf(fc, "squashfs: unable to set blocksize\n");
196+
return -EINVAL;
197+
}
198+
194199
sb->s_fs_info = kzalloc(sizeof(*msblk), GFP_KERNEL);
195200
if (sb->s_fs_info == NULL) {
196201
ERROR("Failed to allocate squashfs_sb_info\n");
@@ -201,12 +206,7 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc)
201206

202207
msblk->panic_on_errors = (opts->errors == Opt_errors_panic);
203208

204-
msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);
205-
if (!msblk->devblksize) {
206-
errorf(fc, "squashfs: unable to set blocksize\n");
207-
return -EINVAL;
208-
}
209-
209+
msblk->devblksize = devblksize;
210210
msblk->devblksize_log2 = ffz(~msblk->devblksize);
211211

212212
mutex_init(&msblk->meta_index_mutex);

0 commit comments

Comments
 (0)