From: Bingwu Zhang <[email protected]> erofs_fragment_pack may initialize fi->list as a new list head instead of adding it to a bucket. If fi->pos is non-zero, the fragmentitem and data buffer is not released by erofs_fragment_commit, leading to a memory leak.
Signed-off-by: Bingwu Zhang <[email protected]> --- Reproducer: mkfs.erofs -d9 -Eztailpacking -Einline_data \ -Efragments -zzstd --zD data.erofs data Direct leak of 5080 byte(s) in 127 object(s) allocated from: #0 0x559bf549b788 in malloc (/home/xtex/src/erofs/erofs-utils/mkfs/mkfs.erofs+0x10f788) #1 0x559bf554391e in erofs_fragment_pack /home/xtex/src/erofs/erofs-utils/lib/fragments.c:205:7 #2 0x559bf554426a in erofs_pack_file_from_fd /home/xtex/src/erofs/erofs-utils/lib/fragments.c:302:7 #3 0x559bf552e89f in erofs_write_compress_dir /home/xtex/src/erofs/erofs-utils/lib/compress.c:2074:8 #4 0x559bf5507421 in erofs_write_dir_file /home/xtex/src/erofs/erofs-utils/lib/inode.c:744:9 #5 0x559bf5507421 in erofs_mkfs_jobfn /home/xtex/src/erofs/erofs-utils/lib/inode.c:1654:9 #6 0x559bf5507421 in z_erofs_mt_dfops_worker /home/xtex/src/erofs/erofs-utils/lib/inode.c:1723:9 #7 0x559bf5498fca in asan_thread_start(void*) asan_interceptors.cpp.o Indirect leak of 7135 byte(s) in 127 object(s) allocated from: #0 0x559bf549b788 in malloc (/home/xtex/src/erofs/erofs-utils/mkfs/mkfs.erofs+0x10f788) #1 0x559bf55439c5 in erofs_fragment_pack /home/xtex/src/erofs/erofs-utils/lib/fragments.c:218:13 #2 0x559bf554426a in erofs_pack_file_from_fd /home/xtex/src/erofs/erofs-utils/lib/fragments.c:302:7 #3 0x559bf552e89f in erofs_write_compress_dir /home/xtex/src/erofs/erofs-utils/lib/compress.c:2074:8 #4 0x559bf5507421 in erofs_write_dir_file /home/xtex/src/erofs/erofs-utils/lib/inode.c:744:9 #5 0x559bf5507421 in erofs_mkfs_jobfn /home/xtex/src/erofs/erofs-utils/lib/inode.c:1654:9 #6 0x559bf5507421 in z_erofs_mt_dfops_worker /home/xtex/src/erofs/erofs-utils/lib/inode.c:1723:9 #7 0x559bf5498fca in asan_thread_start(void*) asan_interceptors.cpp.o --- lib/fragments.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/fragments.c b/lib/fragments.c index 13afce3be537..f137e41b7365 100644 --- a/lib/fragments.c +++ b/lib/fragments.c @@ -325,6 +325,10 @@ int erofs_fragment_commit(struct erofs_inode *inode, u32 tofh) if (fi->pos) { inode->fragmentoff = fi->pos - len; + if (list_empty(&fi->list)) { + free(fi->data); + free(fi); + } return 0; } --- base-commit: 30711d4b2e234fe3e8aaeb779ade4cb609b0d920 change-id: 20260706-fix-frag-leak-f7a6cf172168 Best regards, -- Bingwu Zhang <[email protected]>
