In btrfs_ioctl_snap_create(), vol_args_v2 is not freed if copy_to_user() returns failure. Signed-off-by: Li Zefan <lizf@xxxxxxxxxxxxxx> --- fs/btrfs/ioctl.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index d3f1a60..ba437ad 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -976,7 +976,7 @@ static noinline int btrfs_ioctl_snap_create(struct file *file, if (copy_to_user(arg + offsetof(struct btrfs_ioctl_vol_args_v2, transid), &transid, sizeof(transid))) - return -EFAULT; + ret = -EFAULT; } out: kfree(vol_args); -- 1.6.3 -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
