1From 89bdab965805e8d54d7f75349024e1a11cbe2eb8 Mon Sep 17 00:00:00 2001 2From: Paulo Flabiano Smorigo <pfsmorigo@canonical.com> 3Date: Mon, 14 Dec 2020 18:54:49 -0300 4Subject: [PATCH] zfs: Fix resource leaks while constructing path 5 6There are several exit points in dnode_get_path() that are causing possible 7memory leaks. 8 9In the while(1) the correct exit mechanism should not be to do a direct return, 10but to instead break out of the loop, setting err first if it is not already set. 11 12The reason behind this is that the dnode_path is a linked list, and while doing 13through this loop, it is being allocated and built up - the only way to 14correctly unravel it is to traverse it, which is what is being done at the end 15of the function outside of the loop. 16 17Several of the existing exit points correctly did a break, but not all so this 18change makes that more consistent and should resolve the leaking of memory as 19found by Coverity. 20 21Fixes: CID 73741 22 23Signed-off-by: Paulo Flabiano Smorigo <pfsmorigo@canonical.com> 24Signed-off-by: Darren Kenny <darren.kenny@oracle.com> 25Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 26Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 27--- 28 grub-core/fs/zfs/zfs.c | 30 +++++++++++++++++++++--------- 29 1 file changed, 21 insertions(+), 9 deletions(-) 30 31diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c 32index 0c42cba..9087a72 100644 33--- a/grub-core/fs/zfs/zfs.c 34+++ b/grub-core/fs/zfs/zfs.c 35@@ -2836,8 +2836,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, 36 37 if (dnode_path->dn.dn.dn_type != DMU_OT_DIRECTORY_CONTENTS) 38 { 39- grub_free (path_buf); 40- return grub_error (GRUB_ERR_BAD_FILE_TYPE, N_("not a directory")); 41+ err = grub_error (GRUB_ERR_BAD_FILE_TYPE, N_("not a directory")); 42+ break; 43 } 44 err = zap_lookup (&(dnode_path->dn), cname, &objnum, 45 data, subvol->case_insensitive); 46@@ -2879,11 +2879,18 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, 47 << SPA_MINBLOCKSHIFT); 48 49 if (blksz == 0) 50- return grub_error(GRUB_ERR_BAD_FS, "0-sized block"); 51+ { 52+ err = grub_error (GRUB_ERR_BAD_FS, "0-sized block"); 53+ break; 54+ } 55 56 sym_value = grub_malloc (sym_sz); 57 if (!sym_value) 58- return grub_errno; 59+ { 60+ err = grub_errno; 61+ break; 62+ } 63+ 64 for (block = 0; block < (sym_sz + blksz - 1) / blksz; block++) 65 { 66 void *t; 67@@ -2893,7 +2900,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, 68 if (err) 69 { 70 grub_free (sym_value); 71- return err; 72+ break; 73 } 74 75 movesize = sym_sz - block * blksz; 76@@ -2903,6 +2910,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, 77 grub_memcpy (sym_value + block * blksz, t, movesize); 78 grub_free (t); 79 } 80+ if (err) 81+ break; 82 free_symval = 1; 83 } 84 path = path_buf = grub_malloc (sym_sz + grub_strlen (oldpath) + 1); 85@@ -2911,7 +2920,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, 86 grub_free (oldpathbuf); 87 if (free_symval) 88 grub_free (sym_value); 89- return grub_errno; 90+ err = grub_errno; 91+ break; 92 } 93 grub_memcpy (path, sym_value, sym_sz); 94 if (free_symval) 95@@ -2949,11 +2959,12 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, 96 97 err = zio_read (bp, dnode_path->dn.endian, &sahdrp, NULL, data); 98 if (err) 99- return err; 100+ break; 101 } 102 else 103 { 104- return grub_error (GRUB_ERR_BAD_FS, "filesystem is corrupt"); 105+ err = grub_error (GRUB_ERR_BAD_FS, "filesystem is corrupt"); 106+ break; 107 } 108 109 hdrsize = SA_HDR_SIZE (((sa_hdr_phys_t *) sahdrp)); 110@@ -2974,7 +2985,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, 111 if (!path_buf) 112 { 113 grub_free (oldpathbuf); 114- return grub_errno; 115+ err = grub_errno; 116+ break; 117 } 118 grub_memcpy (path, sym_value, sym_sz); 119 path [sym_sz] = 0; 120-- 1212.14.2 122 123