From: Haoxiang Li lihaoxiang@isrc.iscas.ac.cn
[ Upstream commit fc40459de82543b565ebc839dca8f7987f16f62e ]
xfs_buf_item_get_format() may allocate memory for bip->bli_formats, free the memory in the error path.
Fixes: c3d5f0c2fb85 ("xfs: complain if anyone tries to create a too-large buffer log item") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li lihaoxiang@isrc.iscas.ac.cn Reviewed-by: Christoph Hellwig hch@lst.de Reviewed-by: Carlos Maiolino cmaiolino@redhat.com Signed-off-by: Carlos Maiolino cem@kernel.org [ Adjust context ] Signed-off-by: Sasha Levin sashal@kernel.org --- fs/xfs/xfs_buf_item.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c index a3d5ecccfc2c..deb69740d492 100644 --- a/fs/xfs/xfs_buf_item.c +++ b/fs/xfs/xfs_buf_item.c @@ -744,6 +744,7 @@ xfs_buf_item_init( map_size = DIV_ROUND_UP(chunks, NBWORD);
if (map_size > XFS_BLF_DATAMAP_SIZE) { + xfs_buf_item_free_format(bip); kmem_cache_free(xfs_buf_item_zone, bip); xfs_err(mp, "buffer item dirty bitmap (%u uints) too small to reflect %u bytes!",