From: Phillip Potter <phil@philpotter.co.uk>
Date: Mon, 12 Apr 2021 07:38:37 +0000 (+0100)
Subject: ext4: fix memory leak in ext4_mb_init_backend on error path.
X-Git-Tag: v5.10.43~33
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2050c6e5b161e5e25ce3c420fef58b24fa388a49;p=thirdparty%2Fkernel%2Fstable.git

ext4: fix memory leak in ext4_mb_init_backend on error path.

commit a8867f4e3809050571c98de7a2d465aff5e4daf5 upstream.

Fix a memory leak discovered by syzbot when a file system is corrupted
with an illegally large s_log_groups_per_flex.

Reported-by: syzbot+aa12d6106ea4ca1b6aae@syzkaller.appspotmail.com
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20210412073837.1686-1-phil@philpotter.co.uk
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index b6229fe1aa233..9c390c3d7fb15 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2738,7 +2738,7 @@ static int ext4_mb_init_backend(struct super_block *sb)
 		 */
 		if (sbi->s_es->s_log_groups_per_flex >= 32) {
 			ext4_msg(sb, KERN_ERR, "too many log groups per flexible block group");
-			goto err_freesgi;
+			goto err_freebuddy;
 		}
 		sbi->s_mb_prefetch = min_t(uint, 1 << sbi->s_es->s_log_groups_per_flex,
 			BLK_MAX_SEGMENT_SIZE >> (sb->s_blocksize_bits - 9));