Skip to content

Commit

Permalink
hostfs: fix memory handling in follow_link()
Browse files Browse the repository at this point in the history
[ Upstream commit 7f6c411 ]

1) argument should not be freed in any case - the caller already has
it as ->s_fs_info (and uses it a lot afterwards)
2) allocate readlink buffer with kmalloc() - the caller has no way
to tell if it's got that (on absolute symlink) or a result of
kasprintf().  Sure, for SLAB and SLUB kfree() works on results of
kmem_cache_alloc(), but that's not documented anywhere, might change
in the future *and* is already not true for SLOB.

Fixes: 52b209f ("get rid of hostfs_read_inode()")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
  • Loading branch information
Al Viro authored and gregkh committed Apr 14, 2021
1 parent 3cc4db1 commit e5a3449
Showing 1 changed file with 3 additions and 4 deletions.
7 changes: 3 additions & 4 deletions fs/hostfs/hostfs_kern.c
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ static char *follow_link(char *link)
char *name, *resolved, *end;
int n;

name = __getname();
name = kmalloc(PATH_MAX, GFP_KERNEL);
if (!name) {
n = -ENOMEM;
goto out_free;
Expand Down Expand Up @@ -171,12 +171,11 @@ static char *follow_link(char *link)
goto out_free;
}

__putname(name);
kfree(link);
kfree(name);
return resolved;

out_free:
__putname(name);
kfree(name);
return ERR_PTR(n);
}

Expand Down

0 comments on commit e5a3449

Please sign in to comment.