[Bug] dfs: `utimensat()` leaks `link_fn` on early error paths

[K-ANOY]

RT-Thread Version

RT-Thread master (f12485a60e), source version 5.3.0.

Hardware Type/Architectures

Not hardware-specific. This is a source-level cleanup issue in DFS POSIX compatibility code: components/dfs/dfs_v2/src/dfs_posix.c

Develop Toolchain

Other

Describe the bug

In components/dfs/dfs_v2/src/dfs_posix.c, utimensat() allocates link_fn before validating __path and before several early-return checks:

char *link_fn = (char *)rt_malloc(DFS_PATH_MAX);
int err;

if (__path == NULL)
{
    return -EFAULT;
}

If __path == NULL, the function returns immediately and leaks link_fn.

There are additional early-return paths before the final rt_free(link_fn), for example:

if (stat(__path, &buffer) < 0)
{
    return -ENOENT;
}

and:

d = fd_get(__fd);
if (!d || !d->vnode)
{
    return -EBADF;
}

fullpath = dfs_dentry_full_path(d->dentry);
if (!fullpath)
{
    rt_set_errno(-ENOMEM);
    return -1;
}

The function only frees link_fn on later paths:

ret = dfs_file_setattr(fullpath, &attr);
rt_free(link_fn);

return ret;

Steps to reproduce the behavior

Any caller that reaches an early error path after link_fn is allocated can trigger the leak. For example:

1. Call utimensat() with __path == NULL.
2. link_fn is allocated with rt_malloc(DFS_PATH_MAX).
3. The function returns -EFAULT.
4. link_fn is not freed.

Other examples include paths where stat(__path, &buffer) fails, fd_get(__fd) fails, or dfs_dentry_full_path() fails.

Other additional context

No response