ceph: fix memory leaks in ceph_mdsc_build_path()

Add __putname() calls to error code paths that did not free the "path"
pointer obtained by __getname().  If ownership of this pointer is not
passed to the caller via path_info.path, the function must free it
before returning.

Cc: stable@vger.kernel.org
Fixes: 3fd945a79e14 ("ceph: encode encrypted name in ceph_mdsc_build_path and dentry release")
Fixes: 550f7ca98ee0 ("ceph: give up on paths longer than PATH_MAX")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 23b6d00643c9d1bf192adc24426f5f85f67922ba..b1746273f1863a5ad75fbaa7d8d628aaaaebe12d 100644 (file)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2768,6 +2768,7 @@ retry:
                        if (ret < 0) {
                                dput(parent);
                                dput(cur);
+                               __putname(path);
                                return ERR_PTR(ret);
                        }
 
@@ -2777,6 +2778,7 @@ retry:
                                if (len < 0) {
                                        dput(parent);
                                        dput(cur);
+                                       __putname(path);
                                        return ERR_PTR(len);
                                }
                        }
@@ -2813,6 +2815,7 @@ retry:
                 * cannot ever succeed.  Creating paths that long is
                 * possible with Ceph, but Linux cannot use them.
                 */
+               __putname(path);
                return ERR_PTR(-ENAMETOOLONG);
        }