[PATCH 1/3] ubifs: gc: fix authentication node leak

From: shao.mingyin

Date: Mon Nov 02 2026 - 07:34:33 EST


move_nodes() allocates the authentication node, writes it to the GC
write-buffer and only frees it on the error paths. Every GC pass that
moves nodes on an authenticated file system therefore leaks
ubifs_auth_node_sz() bytes.

Free the buffer after it has been written to the write-buffer.

Fixes: 6f06d96fdf62 ("ubifs: Add auth nodes to garbage collector journal head")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 933c79b5cd6b..2b0f29423f48 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -427,6 +427,7 @@ static int move_nodes(struct ubifs_info *c, struct ubifs_scan_leb *sleb)
kfree(auth);
goto out;
}
+ kfree(auth);

ubifs_add_dirt(c, wbuf->lnum, ubifs_auth_node_sz(c));
}