rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.
Vulnerability ID: CVE-2018-6333
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/facebook/nuclide
Published: 2018-12-31
File: pkg/nuclide-hhvm/lib/main.js
Commit message: Ignore invalid hostnames in hhvm-attach deep link

Summary: Provide nicer handling and an error message when following a deep link requesting HHVM debugger attach that has a malformed host name.

Reviewed By: hansonw

Differential Revision: D7308417

fbshipit-source-id: 60bae4013444008980dda9cda8dec5f8ae20944f
Commit author: Eric Bluestein

Vulnerable version (before fix):
 class Activation {     }      const host = nuclideUri.getHostname(pathString);     const cwd = nuclideUri.createRemoteUri(host, hackRootString);     const notification = atom.notifications.addInfo(       startDebugger

Fixed version (after fix):
 class Activation {     }      const host = nuclideUri.getHostname(pathString);      // Allow only valid hostname characters, per RFC 952:     // https://tools.ietf.org/html/rfc952     const invalidMatch = host.match(/[^A-Za-z0-9\-._]+/);     if (invalidMatch != null) {       atom.notifications.addError(         'The specified host name contained invalid characters.',       );       return;     }      const cwd = nuclideUri.createRemoteUri(host, hackRootString);     const notification = atom.notifications.addInfo(       startDebugger

Patch:
patch: @@ -113,6 +113,17 @@ class Activation {
     }
 
     const host = nuclideUri.getHostname(pathString);
+
+    // Allow only valid hostname characters, per RFC 952:
+    // https://tools.ietf.org/html/rfc952
+    const invalidMatch = host.match(/[^A-Za-z0-9\-._]+/);
+    if (invalidMatch != null) {
+      atom.notifications.addError(
+        'The specified host name contained invalid characters.',
+      );
+      return;
+    }
+
     const cwd = nuclideUri.createRemoteUri(host, hackRootString);
     const notification = atom.notifications.addInfo(
       startDebugger
path: pkg/nuclide-hhvm/lib/main.js
Vulnerability: Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.
Vulnerability ID: CVE-2018-6343
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/facebook/proxygen
Published: 2018-12-31
File: proxygen/lib/http/session/HTTPSession.cpp
Commit message: Check that a secondary auth manager is set before dereferencing.

Summary: CVE-2018-6343

Reviewed By: mingtaoy

Differential Revision: D12994423

fbshipit-source-id: 9229ec11da8085f1fa153595e8e5353e19d06fb7
Commit author: Kyle Nekritz

Vulnerable version (before fix):
 void HTTPSession::onCertificateRequest(uint16_t requestId,   DestructorGuard dg(this);   VLOG(4) << "CERTIFICATE_REQUEST on" << *this << ", requestId=" << requestId;    std::pair<uint16_t, std::unique_ptr<folly::IOBuf>> authenticator;   auto fizzBase = getTransport()->getUnderlyingTransport<AsyncFizzBase>();   if (fizzBase) { void HTTPSession::onCertificate(uint16_t certId,   DestructorGuard dg(this);   VLOG(4) << "CERTIFICATE on" << *this << ", certId=" << certId;    bool isValid = false;   auto fizzBase = getTransport()->getUnderlyingTransport<AsyncFizzBase>();   if (fizzBase) {

Fixed version (after fix):
 void HTTPSession::onCertificateRequest(uint16_t requestId,   DestructorGuard dg(this);   VLOG(4) << "CERTIFICATE_REQUEST on" << *this << ", requestId=" << requestId;    if (!secondAuthManager_) {     return;   }    std::pair<uint16_t, std::unique_ptr<folly::IOBuf>> authenticator;   auto fizzBase = getTransport()->getUnderlyingTransport<AsyncFizzBase>();   if (fizzBase) { void HTTPSession::onCertificate(uint16_t certId,   DestructorGuard dg(this);   VLOG(4) << "CERTIFICATE on" << *this << ", certId=" << certId;    if (!secondAuthManager_) {     return;   }    bool isValid = false;   auto fizzBase = getTransport()->getUnderlyingTransport<AsyncFizzBase>();   if (fizzBase) {

Patch:
patch: @@ -1349,6 +1349,10 @@ void HTTPSession::onCertificateRequest(uint16_t requestId,
   DestructorGuard dg(this);
   VLOG(4) << "CERTIFICATE_REQUEST on" << *this << ", requestId=" << requestId;
 
+  if (!secondAuthManager_) {
+    return;
+  }
+
   std::pair<uint16_t, std::unique_ptr<folly::IOBuf>> authenticator;
   auto fizzBase = getTransport()->getUnderlyingTransport<AsyncFizzBase>();
   if (fizzBase) {
@@ -1382,6 +1386,10 @@ void HTTPSession::onCertificate(uint16_t certId,
   DestructorGuard dg(this);
   VLOG(4) << "CERTIFICATE on" << *this << ", certId=" << certId;
 
+  if (!secondAuthManager_) {
+    return;
+  }
+
   bool isValid = false;
   auto fizzBase = getTransport()->getUnderlyingTransport<AsyncFizzBase>();
   if (fizzBase) {
path: proxygen/lib/http/session/HTTPSession.cpp
Vulnerability: templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter.
Vulnerability ID: CVE-2018-6354
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/formspree/formspree
Published: 2018-01-27
File: formspree/templates/forms/thanks.html
Commit message: Remove XSS opportunity
Commit author: Rohit Datta

Vulnerable version (before fix):
     <div class="container">       <div class="col-1-1">         <h1>Form submitted successfully</h1>         {% if request.args.get('next') %}           <a href="{{ request.args.get('next') }}" class="button" style="margin-top: 1em;">Return to original site</a>         {% endif %}       </div>     </div>   </div>

Fixed version (after fix):
     <div class="container">       <div class="col-1-1">         <h1>Form submitted successfully</h1>       </div>     </div>   </div>

Patch:
patch: @@ -11,9 +11,6 @@
     <div class="container">
       <div class="col-1-1">
         <h1>Form submitted successfully</h1>
-        {% if request.args.get('next') %}
-          <a href="{{ request.args.get('next') }}" class="button" style="margin-top: 1em;">Return to original site</a>
-        {% endif %}
       </div>
     </div>
   </div>
path: formspree/templates/forms/thanks.html
Vulnerability: view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filter_ensure_valid_filter call in current_user_api.php.
Vulnerability ID: CVE-2018-6526
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2018-02-02
File: core/current_user_api.php
Commit message: Fix PHP error - wrong argument type

Initialize $t_filter variable as array() instead of '' in
current_user_get_bug_filter(), to ensure its type is correct when
calling filter_ensure_valid_filter().

Fixes #23921
Commit author: Damien Regad

Vulnerable version (before fix):
 function current_user_ensure_unprotected() {  */ function current_user_get_bug_filter( $p_project_id = null ) { 	$f_filter_string = gpc_get_string( 'filter', '' ); 	$t_filter = '';  	if( !is_blank( $f_filter_string ) ) { 		if( is_numeric( $f_filter_string ) ) {

Fixed version (after fix):
 function current_user_ensure_unprotected() {  */ function current_user_get_bug_filter( $p_project_id = null ) { 	$f_filter_string = gpc_get_string( 'filter', '' ); 	$t_filter = array();  	if( !is_blank( $f_filter_string ) ) { 		if( is_numeric( $f_filter_string ) ) {

Patch:
patch: @@ -238,7 +238,7 @@ function current_user_ensure_unprotected() {
  */
 function current_user_get_bug_filter( $p_project_id = null ) {
 	$f_filter_string = gpc_get_string( 'filter', '' );
-	$t_filter = '';
+	$t_filter = array();
 
 	if( !is_blank( $f_filter_string ) ) {
 		if( is_numeric( $f_filter_string ) ) {
path: core/current_user_api.php
Vulnerability: Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php.
Vulnerability ID: CVE-2018-6550
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/monstra-cms/monstra
Published: 2018-02-02
File: plugins/box/pages/pages.plugin.php
Commit message: Prevent Stored XSS Vulnerability
Commit author: Nikhil Mittal

Vulnerable version (before fix):
 public static function content($slug = '')      */     public static function title()     {         return !empty(Pages::$page['meta_title']) ? Pages::$page['meta_title'] : Pages::$page['title'];     }      /**

Fixed version (after fix):
 public static function content($slug = '')      */     public static function title()     {        $test = !empty(Pages::$page['meta_title']) ? Pages::$page['meta_title'] : Pages::$page['title'];        return htmlspecialchars($test);     }      /**

Patch:
patch: @@ -283,7 +283,8 @@ public static function content($slug = '')
      */
     public static function title()
     {
-        return !empty(Pages::$page['meta_title']) ? Pages::$page['meta_title'] : Pages::$page['title'];
+       $test = !empty(Pages::$page['meta_title']) ? Pages::$page['meta_title'] : Pages::$page['title'];
+       return htmlspecialchars($test);
     }
 
     /**
path: plugins/box/pages/pages.plugin.php
Vulnerability: soundlib/Load_stp.cpp in OpenMPT through 1.27.04.00, and libopenmpt before 0.3.6, has an out-of-bounds read via a malformed STP file.
Vulnerability ID: CVE-2018-6611
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/OpenMPT/openmpt
Published: 2018-02-04
File: soundlib/Load_stp.cpp
Commit message: [Sec] STP: Possible out-of-bounds memory read with malformed STP files (caught with afl-fuzz).
Patch-by: sagamusix
(originally committed as part of r9568)


git-svn-id: https://source.openmpt.org/svn/openmpt/branches/OpenMPT-1.27@9576 56274372-70c3-4bfc-bfc3-4c3a0b034d27
Commit author: Jörn Heusipp

Vulnerable version (before fix):
 static TEMPO ConvertTempo(uint16 ciaSpeed)  static void ConvertLoopSlice(ModSample &src, ModSample &dest, SmpLength start, SmpLength len, bool loop) { 	if(!src.HasSampleData()) return;  	dest.FreeSample(); 	dest = src; static void ConvertLoopSequence(ModSample &smp, STPLoopList &loopList)  		// If adding this loop would cause the sample length to exceed maximum, 		// then limit and bail out 		if((newSmp.nLength + info.loopLength > MAX_SAMPLE_LENGTH) || 		   (info.loopLength > MAX_SAMPLE_LENGTH) || 		   (info.loopStart + info.loopLength > smp.nLength)) 		{ 			numLoops = i; 			break;

Fixed version (after fix):
 static TEMPO ConvertTempo(uint16 ciaSpeed)  static void ConvertLoopSlice(ModSample &src, ModSample &dest, SmpLength start, SmpLength len, bool loop) { 	if(!src.HasSampleData() 		|| start >= src.nLength 		|| src.nLength - start < len) 	{ 		return; 	}  	dest.FreeSample(); 	dest = src; static void ConvertLoopSequence(ModSample &smp, STPLoopList &loopList)  		// If adding this loop would cause the sample length to exceed maximum, 		// then limit and bail out 		if(info.loopStart >= smp.nLength 			|| smp.nLength - info.loopStart < info.loopLength 			|| newSmp.nLength > MAX_SAMPLE_LENGTH - info.loopLength) 		{ 			numLoops = i; 			break;

Patch:
patch: @@ -108,7 +108,12 @@ static TEMPO ConvertTempo(uint16 ciaSpeed)
 
 static void ConvertLoopSlice(ModSample &src, ModSample &dest, SmpLength start, SmpLength len, bool loop)
 {
-	if(!src.HasSampleData()) return;
+	if(!src.HasSampleData()
+		|| start >= src.nLength
+		|| src.nLength - start < len)
+	{
+		return;
+	}
 
 	dest.FreeSample();
 	dest = src;
@@ -156,9 +161,9 @@ static void ConvertLoopSequence(ModSample &smp, STPLoopList &loopList)
 
 		// If adding this loop would cause the sample length to exceed maximum,
 		// then limit and bail out
-		if((newSmp.nLength + info.loopLength > MAX_SAMPLE_LENGTH) ||
-		   (info.loopLength > MAX_SAMPLE_LENGTH) ||
-		   (info.loopStart + info.loopLength > smp.nLength))
+		if(info.loopStart >= smp.nLength
+			|| smp.nLength - info.loopStart < info.loopLength
+			|| newSmp.nLength > MAX_SAMPLE_LENGTH - info.loopLength)
 		{
 			numLoops = i;
 			break;
path: soundlib/Load_stp.cpp
Vulnerability: The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.
Vulnerability ID: CVE-2018-6621
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2018-02-05
File: libavcodec/utvideodec.c
Commit message: avcodec/utvideodec: Fix bytes left check in decode_frame()

Fixes: out of array read
Fixes: poc-2017.avi

Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 118e1b0b3370dd1c0da442901b486689efd1654b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,             for (j = 0; j < c->slices; j++) {                 slice_end   = bytestream2_get_le32u(&gb);                 if (slice_end < 0 || slice_end < slice_start ||                     bytestream2_get_bytes_left(&gb) < slice_end) {                     av_log(avctx, AV_LOG_ERROR, "Incorrect slice size\n");                     return AVERROR_INVALIDDATA;                 }

Fixed version (after fix):
 static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,             for (j = 0; j < c->slices; j++) {                 slice_end   = bytestream2_get_le32u(&gb);                 if (slice_end < 0 || slice_end < slice_start ||                     bytestream2_get_bytes_left(&gb) < slice_end + 1024LL) {                     av_log(avctx, AV_LOG_ERROR, "Incorrect slice size\n");                     return AVERROR_INVALIDDATA;                 }

Patch:
patch: @@ -534,7 +534,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             for (j = 0; j < c->slices; j++) {
                 slice_end   = bytestream2_get_le32u(&gb);
                 if (slice_end < 0 || slice_end < slice_start ||
-                    bytestream2_get_bytes_left(&gb) < slice_end) {
+                    bytestream2_get_bytes_left(&gb) < slice_end + 1024LL) {
                     av_log(avctx, AV_LOG_ERROR, "Incorrect slice size\n");
                     return AVERROR_INVALIDDATA;
                 }
path: libavcodec/utvideodec.c
Vulnerability: The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.
Vulnerability ID: CVE-2018-6758
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/unbit/uwsgi
Published: 2018-02-06
File: core/utils.c
Commit message: improve uwsgi_expand_path() to sanitize input, avoiding stack corruption and potential security issue
Commit author: Unbit

Vulnerable version (before fix):
 void uwsgi_write_pidfile_explicit(char *pidfile_name, pid_t pid) { }  char *uwsgi_expand_path(char *dir, int dir_len, char *ptr) { 	char src[PATH_MAX + 1]; 	memcpy(src, dir, dir_len); 	src[dir_len] = 0; 	char *dst = ptr; 	if (!dst) 		dst = uwsgi_malloc(PATH_MAX + 1); 	if (!realpath(src, dst)) { 		uwsgi_error_realpath(src); 		if (!ptr) 			free(dst); 		return NULL; 	} 	return dst; } 

Fixed version (after fix):
 void uwsgi_write_pidfile_explicit(char *pidfile_name, pid_t pid) { }  char *uwsgi_expand_path(char *dir, int dir_len, char *ptr) { 	if (dir_len > PATH_MAX) 	{ 		uwsgi_log("invalid path size: %d (max %d)\n", dir_len, PATH_MAX); 		return NULL; 	} 	char *src = uwsgi_concat2n(dir, dir_len, "", 0); 	char *dst = ptr; 	if (!dst) 		dst = uwsgi_malloc(PATH_MAX + 1); 	if (!realpath(src, dst)) { 		uwsgi_error_realpath(src); 		if (!ptr) 			free(dst); 		free(src); 		return NULL; 	} 	free(src); 	return dst; } 

Patch:
patch: @@ -3674,18 +3674,23 @@ void uwsgi_write_pidfile_explicit(char *pidfile_name, pid_t pid) {
 }
 
 char *uwsgi_expand_path(char *dir, int dir_len, char *ptr) {
-	char src[PATH_MAX + 1];
-	memcpy(src, dir, dir_len);
-	src[dir_len] = 0;
+	if (dir_len > PATH_MAX)
+	{
+		uwsgi_log("invalid path size: %d (max %d)\n", dir_len, PATH_MAX);
+		return NULL;
+	}
+	char *src = uwsgi_concat2n(dir, dir_len, "", 0);
 	char *dst = ptr;
 	if (!dst)
 		dst = uwsgi_malloc(PATH_MAX + 1);
 	if (!realpath(src, dst)) {
 		uwsgi_error_realpath(src);
 		if (!ptr)
 			free(dst);
+		free(src);
 		return NULL;
 	}
+	free(src);
 	return dst;
 }
path: core/utils.c
Vulnerability: The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value.
Vulnerability ID: CVE-2018-6927
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2018-02-12
File: kernel/futex.c
Commit message: futex: Prevent overflow by strengthen input validation

UBSAN reports signed integer overflow in kernel/futex.c:

 UBSAN: Undefined behaviour in kernel/futex.c:2041:18
 signed integer overflow:
 0 - -2147483648 cannot be represented in type 'int'

Add a sanity check to catch negative values of nr_wake and nr_requeue.

Signed-off-by: Li Jinyue <lijinyue@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: peterz@infradead.org
Cc: dvhart@infradead.org
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1513242294-31786-1-git-send-email-lijinyue@huawei.com
Commit author: Li Jinyue

Vulnerable version (before fix):
 static int futex_requeue(u32 __user *uaddr1, unsigned int flags, 	struct futex_q *this, *next; 	DEFINE_WAKE_Q(wake_q);  	/* 	 * When PI not supported: return -ENOSYS if requeue_pi is true, 	 * consequently the compiler knows requeue_pi is always false past

Fixed version (after fix):
 static int futex_requeue(u32 __user *uaddr1, unsigned int flags, 	struct futex_q *this, *next; 	DEFINE_WAKE_Q(wake_q);  	if (nr_wake < 0 || nr_requeue < 0) 		return -EINVAL;  	/* 	 * When PI not supported: return -ENOSYS if requeue_pi is true, 	 * consequently the compiler knows requeue_pi is always false past

Patch:
patch: @@ -1878,6 +1878,9 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 	struct futex_q *this, *next;
 	DEFINE_WAKE_Q(wake_q);
 
+	if (nr_wake < 0 || nr_requeue < 0)
+		return -EINVAL;
+
 	/*
 	 * When PI not supported: return -ENOSYS if requeue_pi is true,
 	 * consequently the compiler knows requeue_pi is always false past
path: kernel/futex.c
Vulnerability: The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.
Vulnerability ID: CVE-2018-7253
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/dbry/WavPack
Published: 2018-02-19
File: cli/dsdiff.c
Commit message: issue #28, do not overwrite heap on corrupt DSDIFF file
Commit author: David Bryant

Vulnerable version (before fix):
 int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa                 error_line ("dsdiff file version = 0x%08x", version);         }         else if (!strncmp (dff_chunk_header.ckID, "PROP", 4)) {             char *prop_chunk = malloc ((size_t) dff_chunk_header.ckDataSize);              if (!DoReadFile (infile, prop_chunk, (uint32_t) dff_chunk_header.ckDataSize, &bcount) ||                 bcount != dff_chunk_header.ckDataSize) {

Fixed version (after fix):
 int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa                 error_line ("dsdiff file version = 0x%08x", version);         }         else if (!strncmp (dff_chunk_header.ckID, "PROP", 4)) {             char *prop_chunk;              if (dff_chunk_header.ckDataSize < 4 || dff_chunk_header.ckDataSize > 1024) {                 error_line ("%s is not a valid .DFF file!", infilename);                 return WAVPACK_SOFT_ERROR;             }              if (debug_logging_mode)                 error_line ("got PROP chunk of %d bytes total", (int) dff_chunk_header.ckDataSize);              prop_chunk = malloc ((size_t) dff_chunk_header.ckDataSize);              if (!DoReadFile (infile, prop_chunk, (uint32_t) dff_chunk_header.ckDataSize, &bcount) ||                 bcount != dff_chunk_header.ckDataSize) {

Patch:
patch: @@ -153,7 +153,17 @@ int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa
                 error_line ("dsdiff file version = 0x%08x", version);
         }
         else if (!strncmp (dff_chunk_header.ckID, "PROP", 4)) {
-            char *prop_chunk = malloc ((size_t) dff_chunk_header.ckDataSize);
+            char *prop_chunk;
+
+            if (dff_chunk_header.ckDataSize < 4 || dff_chunk_header.ckDataSize > 1024) {
+                error_line ("%s is not a valid .DFF file!", infilename);
+                return WAVPACK_SOFT_ERROR;
+            }
+
+            if (debug_logging_mode)
+                error_line ("got PROP chunk of %d bytes total", (int) dff_chunk_header.ckDataSize);
+
+            prop_chunk = malloc ((size_t) dff_chunk_header.ckDataSize);
 
             if (!DoReadFile (infile, prop_chunk, (uint32_t) dff_chunk_header.ckDataSize, &bcount) ||
                 bcount != dff_chunk_header.ckDataSize) {
path: cli/dsdiff.c
Vulnerability: The blkcg_init_queue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure.
Vulnerability ID: CVE-2018-7480
CWE: CWE-415
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2018-02-25
File: block/blk-cgroup.c
Commit message: blkcg: fix double free of new_blkg in blkcg_init_queue

If blkg_create fails, new_blkg passed as an argument will
be freed by blkg_create, so there is no need to free it again.

Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Commit author: Hou Tao

Vulnerable version (before fix):
 int blkcg_init_queue(struct request_queue *q) 	if (preloaded) 		radix_tree_preload_end();  	if (IS_ERR(blkg)) { 		blkg_free(new_blkg); 		return PTR_ERR(blkg); 	}  	q->root_blkg = blkg; 	q->root_rl.blkg = blkg;

Fixed version (after fix):
 int blkcg_init_queue(struct request_queue *q) 	if (preloaded) 		radix_tree_preload_end();  	if (IS_ERR(blkg)) 		return PTR_ERR(blkg);  	q->root_blkg = blkg; 	q->root_rl.blkg = blkg;

Patch:
patch: @@ -1079,10 +1079,8 @@ int blkcg_init_queue(struct request_queue *q)
 	if (preloaded)
 		radix_tree_preload_end();
 
-	if (IS_ERR(blkg)) {
-		blkg_free(new_blkg);
+	if (IS_ERR(blkg))
 		return PTR_ERR(blkg);
-	}
 
 	q->root_blkg = blkg;
 	q->root_rl.blkg = blkg;
path: block/blk-cgroup.c