In the Linux kernel, the following vulnerability has been resolved:

ubifs: dirty_cow_znode: Fix memleak in error handling path

Following process will cause a memleak for copied up znode:

dirty_cow_znode
zn = copy_znode(c, znode);
err = insert_old_idx(c, zbr->lnum, zbr->offs);
if (unlikely(err))
return ERR_PTR(err); // No one refers to zn.

Fix it by adding copied znode back to tnc, then it will be freed
by ubifs_destroy_tnc_subtree() while closing tnc.

Fetch a reproducer in [Link].

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-53227
• https://git.kernel.org/stable/c/011050fc471cd0b32410694facb47bac20e7262b
• https://git.kernel.org/stable/c/10b6c359e374df1120b951768260083ef047d7fb
• https://git.kernel.org/stable/c/122deabfe1428bffe95e2bf364ff8a5059bdf089
• https://git.kernel.org/stable/c/510b80abe8d2d89e4ff21d71f1804ba2e5d3a96b
• https://git.kernel.org/stable/c/5759076fc7c54614084002345a21bc2c578bf4a8
• https://git.kernel.org/stable/c/76c488e8a0e2783c6d8753cb7354a420593e8c30
• https://git.kernel.org/stable/c/9d4768523b092bfb9a9bfa6b1d903b968c8008cf
• https://git.kernel.org/stable/c/bbcf899036eeb98c3a938fb08946c6b52771f71c