1From 23e39f50ca7a107f6b66396ed4d177a914dee035 Mon Sep 17 00:00:00 2001
2From: Marco A Benatto <mbenatto@redhat.com>
3Date: Mon, 7 Dec 2020 11:53:03 -0300
4Subject: [PATCH] disk/ldm: Make sure comp data is freed before exiting from
5 make_vg()
6
7Several error handling paths in make_vg() do not free comp data before
8jumping to fail2 label and returning from the function. This will leak
9memory. So, let's fix all issues of that kind.
10
11Fixes: CID 73804
12
13Signed-off-by: Marco A Benatto <mbenatto@redhat.com>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
16---
17 grub-core/disk/ldm.c | 51 ++++++++++++++++++++++++++++++++++++++++++++-------
18 1 file changed, 44 insertions(+), 7 deletions(-)
19
20diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c
21index 58f8a53..428415f 100644
22--- a/grub-core/disk/ldm.c
23+++ b/grub-core/disk/ldm.c
24@@ -554,7 +554,11 @@ make_vg (grub_disk_t disk,
25 	      comp->segments = grub_calloc (comp->segment_alloc,
26 					    sizeof (*comp->segments));
27 	      if (!comp->segments)
28-		goto fail2;
29+		{
30+		  grub_free (comp->internal_id);
31+		  grub_free (comp);
32+		  goto fail2;
33+		}
34 	    }
35 	  else
36 	    {
37@@ -562,7 +566,11 @@ make_vg (grub_disk_t disk,
38 	      comp->segment_count = 1;
39 	      comp->segments = grub_malloc (sizeof (*comp->segments));
40 	      if (!comp->segments)
41-		goto fail2;
42+		{
43+		  grub_free (comp->internal_id);
44+		  grub_free (comp);
45+		  goto fail2;
46+		}
47 	      comp->segments->start_extent = 0;
48 	      comp->segments->extent_count = lv->size;
49 	      comp->segments->layout = 0;
50@@ -574,15 +582,26 @@ make_vg (grub_disk_t disk,
51 		  comp->segments->layout = GRUB_RAID_LAYOUT_SYMMETRIC_MASK;
52 		}
53 	      else
54-		goto fail2;
55+		{
56+		  grub_free (comp->segments);
57+		  grub_free (comp->internal_id);
58+		  grub_free (comp);
59+		  goto fail2;
60+		}
61 	      ptr += *ptr + 1;
62 	      ptr++;
63 	      if (!(vblk[i].flags & 0x10))
64-		goto fail2;
65+		{
66+		  grub_free (comp->segments);
67+		  grub_free (comp->internal_id);
68+		  grub_free (comp);
69+		  goto fail2;
70+		}
71 	      if (ptr >= vblk[i].dynamic + sizeof (vblk[i].dynamic)
72 		  || ptr + *ptr + 1 >= vblk[i].dynamic
73 		  + sizeof (vblk[i].dynamic))
74 		{
75+		  grub_free (comp->segments);
76 		  grub_free (comp->internal_id);
77 		  grub_free (comp);
78 		  goto fail2;
79@@ -592,6 +611,7 @@ make_vg (grub_disk_t disk,
80 	      if (ptr + *ptr + 1 >= vblk[i].dynamic
81 		  + sizeof (vblk[i].dynamic))
82 		{
83+		  grub_free (comp->segments);
84 		  grub_free (comp->internal_id);
85 		  grub_free (comp);
86 		  goto fail2;
87@@ -601,7 +621,12 @@ make_vg (grub_disk_t disk,
88 	      comp->segments->nodes = grub_calloc (comp->segments->node_alloc,
89 						   sizeof (*comp->segments->nodes));
90 	      if (!lv->segments->nodes)
91-		goto fail2;
92+		{
93+		  grub_free (comp->segments);
94+		  grub_free (comp->internal_id);
95+		  grub_free (comp);
96+		  goto fail2;
97+		}
98 	    }
99
100 	  if (lv->segments->node_alloc == lv->segments->node_count)
101@@ -611,11 +636,23 @@ make_vg (grub_disk_t disk,
102
103 	      if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) ||
104 		  grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz))
105-		goto fail2;
106+		{
107+		  grub_free (comp->segments->nodes);
108+		  grub_free (comp->segments);
109+		  grub_free (comp->internal_id);
110+		  grub_free (comp);
111+		  goto fail2;
112+		}
113
114 	      t = grub_realloc (lv->segments->nodes, sz);
115 	      if (!t)
116-		goto fail2;
117+		{
118+		  grub_free (comp->segments->nodes);
119+		  grub_free (comp->segments);
120+		  grub_free (comp->internal_id);
121+		  grub_free (comp);
122+		  goto fail2;
123+		}
124 	      lv->segments->nodes = t;
125 	    }
126 	  lv->segments->nodes[lv->segments->node_count].pv = 0;
127--
1282.14.2
129
130