From: "Darrick J. Wong" darrick.wong@oracle.com
mainline inclusion from mainline-5.5-rc1 commit 050552cbe06a3a9c3f977dcf11ff998ae1d5c2d5 category: bugfix bugzilla: 26779 CVE: NA
---------------------------
Fix a few places where we xlog_alloc_buffer a buffer, hit an error, and then bail out without freeing the buffer.
Signed-off-by: Darrick J. Wong darrick.wong@oracle.com Reviewed-by: Brian Foster bfoster@redhat.com
Conflict: fs/xfs/xfs_log_recover.c Signed-off-by: yu kuai yukuai3@huawei.com Reviewed-by: Hou Tao houtao1@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- fs/xfs/xfs_log_recover.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c index f2c1054ad00f..ca8075894bea 100644 --- a/fs/xfs/xfs_log_recover.c +++ b/fs/xfs/xfs_log_recover.c @@ -1425,10 +1425,11 @@ xlog_find_tail( error = xlog_rseek_logrec_hdr(log, *head_blk, *head_blk, 1, bp, &rhead_blk, &rhead, &wrapped); if (error < 0) - return error; + goto done; if (!error) { xfs_warn(log->l_mp, "%s: couldn't find sync record", __func__); - return -EFSCORRUPTED; + error = -EFSCORRUPTED; + goto done; } *tail_blk = BLOCK_LSN(be64_to_cpu(rhead->h_tail_lsn));
@@ -5369,8 +5370,10 @@ xlog_do_recovery_pass( "invalid iclog size (%d bytes), using lsunit (%d bytes)", h_size, log->l_mp->m_logbsize); h_size = log->l_mp->m_logbsize; - } else - return -EFSCORRUPTED; + } else { + error = -EFSCORRUPTED; + goto bread_err1; + } }
if ((be32_to_cpu(rhead->h_version) & XLOG_VERSION_2) &&