2009-09-04 07:00:12

by Xiaotian Feng

Subject: [PATCH] drivers/acpi: fix memory leak in acpi_device_set_id

In acpi_device_set_id, if cid_list is allocated by ACPI_ALLOCATE_ZEROED,
it is never freed. This patch fixes the memory leak.

Signed-off-by: Xiaotian Feng <[email protected]>
---
drivers/acpi/scan.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 781435d..a0102ad 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1010,6 +1010,7 @@ static void acpi_device_set_id(struct acpi_device *device,
struct acpi_compatible_id_list *cid_list = NULL;
const char *cid_add = NULL;
acpi_status status;
+ int free_cid_list = 0;

switch (type) {
case ACPI_BUS_TYPE_DEVICE:
@@ -1098,6 +1099,7 @@ static void acpi_device_set_id(struct acpi_device *device,
kfree(buffer.pointer);
return;
} else {
+ free_cid_list = 1;
cid_list->count = 0;
cid_list->size = size;
}
@@ -1124,6 +1126,8 @@ static void acpi_device_set_id(struct acpi_device *device,
printk(KERN_ERR PREFIX "Memory allocation error\n");
}

+ if (free_cid_list)
+ ACPI_FREE(cid_list);
kfree(buffer.pointer);
}

--
1.6.2.5

2009-09-04 15:23:05

by Bjorn Helgaas

Subject: Re: [PATCH] drivers/acpi: fix memory leak in acpi_device_set_id

On Friday 04 September 2009 01:00:19 am Xiaotian Feng wrote:
> In acpi_device_set_id, if cid_list is allocated by ACPI_ALLOCATE_ZEROED,
> it is never freed. This patch fixes the memory leak.

There are several recent changes to this code that remove this leak.
The current acpi-test version:

http://git.kernel.org/?p=linux/kernel/git/lenb/linux-acpi-2.6.git;a=blob;f=drivers/acpi/scan.c;h=e218ec5c6be046171e08a0f2d95a751aee2a9aec;hb=test

does not have the leak, as far as I can tell, because it doesn't have
the cid_list kmalloc().

If it's a serious issue, your patch might be appropriate for -stable,
but I don't think we'll need it in 2.6.32.

Bjorn

> Signed-off-by: Xiaotian Feng <[email protected]>
> ---
> drivers/acpi/scan.c | 4 ++++
> 1 files changed, 4 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
> index 781435d..a0102ad 100644
> --- a/drivers/acpi/scan.c
> +++ b/drivers/acpi/scan.c
> @@ -1010,6 +1010,7 @@ static void acpi_device_set_id(struct acpi_device *device,
> struct acpi_compatible_id_list *cid_list = NULL;
> const char *cid_add = NULL;
> acpi_status status;
> + int free_cid_list = 0;
>
> switch (type) {
> case ACPI_BUS_TYPE_DEVICE:
> @@ -1098,6 +1099,7 @@ static void acpi_device_set_id(struct acpi_device *device,
> kfree(buffer.pointer);
> return;
> } else {
> + free_cid_list = 1;
> cid_list->count = 0;
> cid_list->size = size;
> }
> @@ -1124,6 +1126,8 @@ static void acpi_device_set_id(struct acpi_device *device,
> printk(KERN_ERR PREFIX "Memory allocation error\n");
> }
>
> + if (free_cid_list)
> + ACPI_FREE(cid_list);
> kfree(buffer.pointer);
> }
>