From: Daniel Yang Date: Mon, 16 Sep 2024 23:05:06 +0000 (-0700) Subject: exfat: resolve memory leak from exfat_create_upcase_table() X-Git-Tag: v6.10.13~18 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f9835aec49670c46ebe2973032caaa1043b3d4da;p=thirdparty%2Fkernel%2Fstable.git exfat: resolve memory leak from exfat_create_upcase_table() commit c290fe508eee36df1640c3cb35dc8f89e073c8a8 upstream. If exfat_load_upcase_table reaches end and returns -EINVAL, allocated memory doesn't get freed and while exfat_load_default_upcase_table allocates more memory, leading to a memory leak. Here's link to syzkaller crash report illustrating this issue: https://syzkaller.appspot.com/text?tag=CrashReport&x=1406c201980000 Reported-by: syzbot+e1c69cadec0f1a078e3d@syzkaller.appspotmail.com Fixes: a13d1a4de3b0 ("exfat: move freeing sbi, upcase table and dropping nls into rcu-delayed helper") Cc: stable@vger.kernel.org Signed-off-by: Daniel Yang Signed-off-by: Namjae Jeon Signed-off-by: Greg Kroah-Hartman --- diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c index afdf13c34ff52..1ac011088ce76 100644 --- a/fs/exfat/nls.c +++ b/fs/exfat/nls.c @@ -779,8 +779,11 @@ int exfat_create_upcase_table(struct super_block *sb) le32_to_cpu(ep->dentry.upcase.checksum)); brelse(bh); - if (ret && ret != -EIO) + if (ret && ret != -EIO) { + /* free memory from exfat_load_upcase_table call */ + exfat_free_upcase_table(sbi); goto load_default; + } /* load successfully */ return ret;