For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] btrfs: qgroup: fix memory leak when add_qgroup_item() fails
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
If add_qgroup_item() fails, we jump to the out label without freeing the
preallocated qgroup structure. This causes a memory leak and triggers
the ASSERT(prealloc == NULL) assertion.
Fix this by freeing prealloc and setting it to NULL before jumping to
the out label when add_qgroup_item() fails.
Reported-by: syzbot+803e4cb8245b52928347@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=803e4cb8245b52928347
Fixes: 8d54518b5e52 ("btrfs: qgroup: pre-allocate btrfs_qgroup to reduce GFP_ATOMIC usage")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/btrfs/qgroup.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 9e2b53e90dcb..4dbf6d2d2aaa 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1671,8 +1671,11 @@ int btrfs_create_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid)
}
ret = add_qgroup_item(trans, quota_root, qgroupid);
- if (ret)
+ if (ret) {
+ kfree(prealloc);
+ prealloc = NULL;
goto out;
+ }
spin_lock(&fs_info->qgroup_lock);
qgroup = add_qgroup_rb(fs_info, prealloc, qgroupid);
--
2.43.0