Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Namjae Jeon" <namjae.jeon@samsung.com>
To:     "'Al Viro'" <viro@zeniv.linux.org.uk>
Cc:     <sj1557.seo@samsung.com>, <linux-fsdevel@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>,
        "'syzkaller'" <syzkaller@googlegroups.com>,
        "'butt3rflyh4ck'" <butterflyhuangxx@gmail.com>
In-Reply-To: <20200602162808.GK23230@ZenIV.linux.org.uk>
Subject: RE: memory leak in exfat_parse_param
Date:   Wed, 3 Jun 2020 10:32:41 +0900
Message-ID: <014501d63946$df61a260$9e24e720$@samsung.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Thread-Index: AQKSa5uL/3zbJoN7v+1iAtBKiDoxiAJWHDiqAihSHFqnKbrZcA==
Content-Language: ko
Content-Type: text/plain; charset="utf-8"
CMS-TYPE: 101P
DLP-Filter: Pass
References: <CAFcO6XPVo-u0CkBxy0Ox+FPfqgPUwmo0pnVYrLCP6EM05Sd6-A@mail.gmail.com>
        <CGME20200602162821epcas1p218a2f86ae11943f11ea728d6b0dbdfb6@epcas1p2.samsung.com>
        <20200602162808.GK23230@ZenIV.linux.org.uk>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

> On Tue, Jun 02, 2020 at 01:03:05PM +0800, butt3rflyh4ck wrote:
> > I report a bug (in linux-5.7.0-rc7) found by syzkaller.
> >
> > kernel config:
> > https://protect2.fireeye.com/url?k=f3a88a7d-ae6446d8-f3a90132-0cc47a30
> > d446-6021a2fbdd1681a8&q=1&u=https%3A%2F%2Fgithub.com%2Fbutterflyhack%2
> > Fsyzkaller-fuzz%2Fblob%2Fmaster%2Fconfig-v5.7.0-rc7
> >
> > and can reproduce.
> >
> > A param->string held by exfat_mount_options.
> 
> Humm...
> 
> 	First of all, exfat_free() ought to call exfat_free_upcase_table().
> What's more, WTF bother with that kstrdup(), anyway?  Just steal the string and be done with that...
Thanks for your patch. I will push it to exfat tree.
> 
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
> ---
> diff --git a/fs/exfat/super.c b/fs/exfat/super.c index 0565d5539d57..01cd7ed1614d 100644
> --- a/fs/exfat/super.c
> +++ b/fs/exfat/super.c
> @@ -259,9 +259,8 @@ static int exfat_parse_param(struct fs_context *fc, struct fs_parameter *param)
>  		break;
>  	case Opt_charset:
>  		exfat_free_iocharset(sbi);
> -		opts->iocharset = kstrdup(param->string, GFP_KERNEL);
> -		if (!opts->iocharset)
> -			return -ENOMEM;
> +		opts->iocharset = param->string;
> +		param->string = NULL;
>  		break;
>  	case Opt_errors:
>  		opts->errors = result.uint_32;
> @@ -611,7 +610,10 @@ static int exfat_get_tree(struct fs_context *fc)
> 
>  static void exfat_free(struct fs_context *fc)  {
> -	kfree(fc->s_fs_info);
> +	struct exfat_sb_info *sbi = fc->s_fs_info;
> +
> +	exfat_free_iocharset(sbi);
> +	kfree(sbi);
>  }
> 
>  static const struct fs_context_operations exfat_context_ops = {