Linux Kernel ext4 buffer_head memory leak in ext4_init_orphan_info analysis

Vulnerability Summary Overview Title: Type: Memory Leak (buffer_head leak) Root Cause: When reads extended file blocks, if succeeds but subsequent validation fails, the function returns prematurely. Consequently, the already acquired is not released, resulting in a leak. Scope of Impact Affected Component: Linux kernel ext4 filesystem Trigger Condition: Within , when succeeds but the magic number validation fails ( ), the allocated buffer_head is not released. Fix Solution Fix Strategy: Track the number of successfully read s and accurately release the corresponding number of buffer_heads on the error path. Fix Commit: ("ext4: Speedup orphan inode handling") Patch Link: POC / Fix Code (diff key part) ```c // File: fs/ext4/orphan.c @@ -613,6 +614,7 @@ int ext4_init_orphan_info(struct super_block sb) le32 bdata; int inodes_per_cb = ext4_inodes_per_orphan_block(sb); struct ext4_orphan_block_tail ot; le32 bdata; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int res; int loaded = 0; int

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel ext4 buffer_head memory leak in ext4_init_orphan_info analysis