[LU-6505] __proc_cpt_table use after free

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.8.0
• Severity: 3
• Assignee: WC Triage
• Reporter: Oleg Drokin

Description

smatch highlighted this interesting bit in __proc_cpt_table:

        while (1) {
                LIBCFS_ALLOC(buf, len);
                if (buf == NULL)
                        return -ENOMEM;

                rc = cfs_cpt_table_print(cfs_cpt_table, buf, len);
                if (rc >= 0)
                        break;

                LIBCFS_FREE(buf, len);
                if (rc == -EFBIG) {
                        len <<= 1;
                        continue;
                }
                goto out;
        }
...
 out:
        if (buf != NULL)
                LIBCFS_FREE(buf, len);

This is a pretty obvious double free, so we need to move the free near EFBIG into the if branch.