[PATCH 2/5] NFSv4/flexfiles: fix da_netid leak in nfs4_ff_alloc_deviceid_node()

[Junrui Luo via B4 Relay]

From: Junrui Luo <moonafterrain@xxxxxxxxxxx>

nfs4_decode_mp_ds_addr() allocates the r_netid string and hands ownership
to the nfs4_pnfs_ds_addr it returns. Both loops in
nfs4_ff_alloc_deviceid_node() that drain the local dsaddrs list free only
da_remotestr and the da itself, so the netid is leaked.

The success-path loop runs when nfs4_pnfs_ds_add() finds an equivalent
data server already cached and leaves the caller's list intact; the
out_err_drain_dsaddrs loop runs on every late failure in the function.

da_remotestr and da_netid are the only heap pointers in the structure, so
free both, as nfs4_pnfs_ds_addr_free() does.

Fixes: 4be78d26810b ("NFSv4/pNFS: Store the transport type in struct nfs4_pnfs_ds_addr")
Reported-by: Yuhao Jiang <danisjiang@xxxxxxxxx>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Junrui Luo <moonafterrain@xxxxxxxxxxx>
---
 fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 659a2bf7b502..98d464f402d5 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -169,6 +169,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
 				      da_node);
 		list_del_init(&da->da_node);
 		kfree(da->da_remotestr);
+		kfree(da->da_netid);
 		kfree(da);
 	}
 
@@ -181,6 +182,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
 				      da_node);
 		list_del_init(&da->da_node);
 		kfree(da->da_remotestr);
+		kfree(da->da_netid);
 		kfree(da);
 	}
 

-- 
2.51.2