[3.16.y-ckt stable] Patch "btrfs: fix possible leak in btrfs_ioctl_balance()" has been added to staging queue

[Luis Henriques]

This is a note to let you know that I have just added a patch titled

    btrfs: fix possible leak in btrfs_ioctl_balance()

to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree 
which can be found at:

    http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.16.y-queue

This patch is scheduled to be released in version 3.16.7-ckt20.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.16.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

>From 09221bef628af95513e4f12262019935f6788cba Mon Sep 17 00:00:00 2001
From: Christian Engelmayer <cengelma at gmx.at>
Date: Wed, 21 Oct 2015 00:50:06 +0200
Subject: btrfs: fix possible leak in btrfs_ioctl_balance()

commit 0f89abf56abbd0e1c6e3cef9813e6d9f05383c1e upstream.

Commit 8eb934591f8b ("btrfs: check unsupported filters in balance
arguments") adds a jump to exit label out_bargs in case the argument
check fails. At this point in addition to the bargs memory, the
memory for struct btrfs_balance_control has already been allocated.
Ownership of bctl is passed to btrfs_balance() in the good case,
thus the memory is not freed due to the introduced jump. Make sure
that the memory gets freed in any case as necessary. Detected by
Coverity CID 1328378.

Signed-off-by: Christian Engelmayer <cengelma at gmx.at>
Reviewed-by: David Sterba <dsterba at suse.com>
Signed-off-by: Chris Mason <clm at fb.com>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
 fs/btrfs/ioctl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 8b71c6755e04..0b5f9183362c 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4530,7 +4530,7 @@ locked:

 	if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) {
 		ret = -EINVAL;
-		goto out_bargs;
+		goto out_bctl;
 	}

 do_balance:
@@ -4544,12 +4544,15 @@ do_balance:
 	need_unlock = false;

 	ret = btrfs_balance(bctl, bargs);
+	bctl = NULL;

 	if (arg) {
 		if (copy_to_user(arg, bargs, sizeof(*bargs)))
 			ret = -EFAULT;
 	}

+out_bctl:
+	kfree(bctl);
 out_bargs:
 	kfree(bargs);
 out_unlock: