From: Wenwen Wang wenwen@cs.uga.edu
mainline inclusion from mainline-5.4-rc1 commit cfddf9f4c9f038c91c6c61d5cf3a161731b5c418 category: bugfix bugzilla: 21612 CVE: NA
---------------------------
In __break_lease(), the file lock 'new_fl' is allocated in lease_alloc(). However, it is not deallocated in the following execution if smp_load_acquire() fails, leading to a memory leak bug. To fix this issue, free 'new_fl' before returning the error.
Signed-off-by: Wenwen Wang wenwen@cs.uga.edu Signed-off-by: Jeff Layton jlayton@kernel.org Signed-off-by: Yu Kuai yukuai3@huawei.com Reviewed-by: zhangyi (F) yi.zhang@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- fs/locks.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/locks.c b/fs/locks.c index 28270e74be342..545e79d6eb70b 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -1459,7 +1459,7 @@ int __break_lease(struct inode *inode, unsigned int mode, unsigned int type) ctx = smp_load_acquire(&inode->i_flctx); if (!ctx) { WARN_ON_ONCE(1); - return error; + goto free_lock; }
percpu_down_read_preempt_disable(&file_rwsem); @@ -1539,6 +1539,7 @@ int __break_lease(struct inode *inode, unsigned int mode, unsigned int type) spin_unlock(&ctx->flc_lock); percpu_up_read_preempt_enable(&file_rwsem); locks_dispose_list(&dispose); +free_lock: locks_free_lock(new_fl); return error; }