summaryrefslogtreecommitdiffstats
path: root/fs/jffs2/scan.c
diff options
context:
space:
mode:
authorWenwen Wang <wenwen@cs.uga.edu>2019-08-19 16:55:04 -0500
committerRichard Weinberger <richard@nod.at>2019-09-15 22:42:41 +0200
commit6a379f67454a3c740671ed6c7793b76ffecef50b (patch)
tree14307fd46d3435e8fb8164fad591f5f4f9dea740 /fs/jffs2/scan.c
parent61b875e88a04fd626e68c657400f237af8afa95e (diff)
downloadlinux-stable-6a379f67454a3c740671ed6c7793b76ffecef50b.tar.gz
linux-stable-6a379f67454a3c740671ed6c7793b76ffecef50b.tar.bz2
linux-stable-6a379f67454a3c740671ed6c7793b76ffecef50b.zip
jffs2: Fix memory leak in jffs2_scan_eraseblock() error path
In jffs2_scan_eraseblock(), 'sumptr' is allocated through kmalloc() if 'sumlen' is larger than 'buf_size'. However, it is not deallocated in the following execution if jffs2_fill_scan_buf() fails, leading to a memory leak bug. To fix this issue, free 'sumptr' before returning the error. Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Richard Weinberger <richard@nod.at>
Diffstat (limited to 'fs/jffs2/scan.c')
-rw-r--r--fs/jffs2/scan.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
index 90431dd613b8..5f7e284e0df3 100644
--- a/fs/jffs2/scan.c
+++ b/fs/jffs2/scan.c
@@ -527,8 +527,11 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
err = jffs2_fill_scan_buf(c, sumptr,
jeb->offset + c->sector_size - sumlen,
sumlen - buf_len);
- if (err)
+ if (err) {
+ if (sumlen > buf_size)
+ kfree(sumptr);
return err;
+ }
}
}