{"id":"DEBIAN-CVE-2021-47585","details":"In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix memory leak in __add_inode_ref()  Line 1169 (#3) allocates a memory chunk for victim_name by kmalloc(), but  when the function returns in line 1184 (#4) victim_name allocated by line 1169 (#3) is not freed, which will lead to a memory leak. There is a similar snippet of code in this function as allocating a memory chunk for victim_name in line 1104 (#1) as well as releasing the memory in line 1116 (#2).  We should kfree() victim_name when the return value of backref_in_log() is less than zero and before the function returns in line 1184 (#4).  1057 static inline int __add_inode_ref(struct btrfs_trans_handle *trans, 1058 \t\t\t\t  struct btrfs_root *root, 1059 \t\t\t\t  struct btrfs_path *path, 1060 \t\t\t\t  struct btrfs_root *log_root, 1061 \t\t\t\t  struct btrfs_inode *dir, 1062 \t\t\t\t  struct btrfs_inode *inode, 1063 \t\t\t\t  u64 inode_objectid, u64 parent_objectid, 1064 \t\t\t\t  u64 ref_index, char *name, int namelen, 1065 \t\t\t\t  int *search_done) 1066 {  1104 \tvictim_name = kmalloc(victim_name_len, GFP_NOFS); \t// #1: kmalloc (victim_name-1) 1105 \tif (!victim_name) 1106 \t\treturn -ENOMEM;  1112\tret = backref_in_log(log_root, &search_key, 1113\t\t\tparent_objectid, victim_name, 1114\t\t\tvictim_name_len); 1115\tif (ret \u003c 0) { 1116\t\tkfree(victim_name); // #2: kfree (victim_name-1) 1117\t\treturn ret; 1118\t} else if (!ret) {  1169 \tvictim_name = kmalloc(victim_name_len, GFP_NOFS); \t// #3: kmalloc (victim_name-2) 1170 \tif (!victim_name) 1171 \t\treturn -ENOMEM;  1180 \tret = backref_in_log(log_root, &search_key, 1181 \t\t\tparent_objectid, victim_name, 1182 \t\t\tvictim_name_len); 1183 \tif (ret \u003c 0) { 1184 \t\treturn ret; // #4: missing kfree (victim_name-2) 1185 \t} else if (!ret) {  1241 \treturn 0; 1242 }","modified":"2026-09-15T09:02:40.183057951Z","published":"2024-06-19T15:15:53.057Z","upstream":["CVE-2021-47585"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2021-47585"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.15-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47585.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.15-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47585.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.15-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47585.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}