From 98fc9c2cc45cfcb56961a73de3ec69b474063fc0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lu=C3=ADs=20Henriques?= Date: Wed, 28 Jan 2026 11:07:20 +0000 Subject: [PATCH] ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [ Upstream commit 7ca4b085f430f3774c3838b3da569ceccd6a0177 ] If the filename casefolding fails, we'll be leaking memory from the fscrypt_name struct, namely from the 'crypto_buf.name' member. Make sure we free it in the error path on both ext4_fname_setup_filename() and ext4_fname_prepare_lookup() functions. Cc: stable@kernel.org Fixes: 1ae98e295fa2 ("ext4: optimize match for casefolded encrypted dirs") Signed-off-by: Luís Henriques Reviewed-by: Eric Biggers Link: https://lore.kernel.org/r/20230803091713.13239-1-lhenriques@suse.de Signed-off-by: Theodore Ts'o [ fs/ext4/crypto.c was removed by commit a7550b30ab70 ("ext4 crypto: migrate into vfs's crypto engine") since v4.8, so apply this patch to fs/ext4/ext4.h in v5.15. Move ext4_fname_free_filename() to the front of ext4_fname_setup_filename() to fix a build issue. ] Signed-off-by: Bin Lan Signed-off-by: Greg Kroah-Hartman --- fs/ext4/ext4.h | 38 +++++++++++++++++++++----------------- 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 389251ee9ac9..d2158866a4b5 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -2749,6 +2749,23 @@ static inline void ext4_fname_from_fscrypt_name(struct ext4_filename *dst, dst->crypto_buf = src->crypto_buf; } +static inline void ext4_fname_free_filename(struct ext4_filename *fname) +{ + struct fscrypt_name name; + + name.crypto_buf = fname->crypto_buf; + fscrypt_free_filename(&name); + + fname->crypto_buf.name = NULL; + fname->usr_fname = NULL; + fname->disk_name.name = NULL; + +#ifdef CONFIG_UNICODE + kfree(fname->cf_name.name); + fname->cf_name.name = NULL; +#endif +} + static inline int ext4_fname_setup_filename(struct inode *dir, const struct qstr *iname, int lookup, @@ -2765,6 +2782,8 @@ static inline int ext4_fname_setup_filename(struct inode *dir, #ifdef CONFIG_UNICODE err = ext4_fname_setup_ci_filename(dir, iname, fname); + if (err) + ext4_fname_free_filename(fname); #endif return err; } @@ -2784,26 +2803,11 @@ static inline int ext4_fname_prepare_lookup(struct inode *dir, #ifdef CONFIG_UNICODE err = ext4_fname_setup_ci_filename(dir, &dentry->d_name, fname); + if (err) + ext4_fname_free_filename(fname); #endif return err; } - -static inline void ext4_fname_free_filename(struct ext4_filename *fname) -{ - struct fscrypt_name name; - - name.crypto_buf = fname->crypto_buf; - fscrypt_free_filename(&name); - - fname->crypto_buf.name = NULL; - fname->usr_fname = NULL; - fname->disk_name.name = NULL; - -#ifdef CONFIG_UNICODE - kfree(fname->cf_name.name); - fname->cf_name.name = NULL; -#endif -} #else /* !CONFIG_FS_ENCRYPTION */ static inline int ext4_fname_setup_filename(struct inode *dir, const struct qstr *iname,