btrfs: fix possible leak in btrfs_ioctl_balance()

Commit 8eb9345 ("btrfs: check unsupported filters in balance arguments") adds a jump to exit label out_bargs in case the argument check fails. At this point in addition to the bargs memory, the memory for struct btrfs_balance_control has already been allocated. Ownership of bctl is passed to btrfs_balance() in the good case, thus the memory is not freed due to the introduced jump. Make sure that the memory gets freed in any case as necessary. Detected by Coverity CID 1328378. Signed-off-by: Christian Engelmayer <[email protected]> Reviewed-by: David Sterba <[email protected]> Signed-off-by: Chris Mason <[email protected]>
chewitt · Oct 22, 2015 · 0f89abf · 0f89abf
1 parent 0f6925f
commit 0f89abf
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
@@ -4641,7 +4641,7 @@ static long btrfs_ioctl_balance(struct file *file, void __user *arg)
 
 	if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) {
 		ret = -EINVAL;
-		goto out_bargs;
+		goto out_bctl;
 	}
 
 do_balance:
@@ -4655,12 +4655,15 @@ static long btrfs_ioctl_balance(struct file *file, void __user *arg)
 	need_unlock = false;
 
 	ret = btrfs_balance(bctl, bargs);
+	bctl = NULL;
 
 	if (arg) {
 		if (copy_to_user(arg, bargs, sizeof(*bargs)))
 			ret = -EFAULT;
 	}
 
+out_bctl:
+	kfree(bctl);
 out_bargs:
 	kfree(bargs);
 out_unlock: