2018-01-22 09:41:10

by Colin King

Subject: [PATCH][next] NTB: ntb_tool: fix memory leak on 'buf' on error exit path

From: Colin Ian King <[email protected]>

Currently there is a memory leak on buf when the call to ntb_mw_get_align
fails. Add an exit err label and jump to this so that kfree on buf frees
the memory.

Detected by CoverityScan, CID#1464286 ("Resource leak")

Fixes: d637628ce00c ("NTB: ntb_tool: Add full multi-port NTB API support")
Signed-off-by: Colin Ian King <[email protected]>
---
drivers/ntb/test/ntb_tool.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
index 920fc9b161b0..d592c0ffbd19 100644
--- a/drivers/ntb/test/ntb_tool.c
+++ b/drivers/ntb/test/ntb_tool.c
@@ -659,7 +659,7 @@ static ssize_t tool_mw_trans_read(struct file *filep, char __user *ubuf,
ret = ntb_mw_get_align(inmw->tc->ntb, inmw->pidx, inmw->widx,
&addr_align, &size_align, &size_max);
if (ret)
- return ret;
+ goto err;

off += scnprintf(buf + off, buf_size - off,
"Inbound MW \t%d\n",
@@ -694,6 +694,8 @@ static ssize_t tool_mw_trans_read(struct file *filep, char __user *ubuf,
&size_max);

ret = simple_read_from_buffer(ubuf, size, offp, buf, off);
+
+err:
kfree(buf);

return ret;
--
2.15.1

2018-01-22 10:03:11

by Serge Semin

Subject: Re: [PATCH][next] NTB: ntb_tool: fix memory leak on 'buf' on error exit path

On Mon, Jan 22, 2018 at 09:38:57AM +0000, Colin King <[email protected]> wrote:
> From: Colin Ian King <[email protected]>
>
> Currently there is a memory leak on buf when the call to ntb_mw_get_align
> fails. Add an exit err label and jump to this so that kfree on buf frees
> the memory.
>
> Detected by CoverityScan, CID#1464286 ("Resource leak")
>
> Fixes: d637628ce00c ("NTB: ntb_tool: Add full multi-port NTB API support")
> Signed-off-by: Colin Ian King <[email protected]>

Good catch, thanks!

Acked-by: Serge Semin <[email protected]>

> ---
> drivers/ntb/test/ntb_tool.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
> index 920fc9b161b0..d592c0ffbd19 100644
> --- a/drivers/ntb/test/ntb_tool.c
> +++ b/drivers/ntb/test/ntb_tool.c
> @@ -659,7 +659,7 @@ static ssize_t tool_mw_trans_read(struct file *filep, char __user *ubuf,
> ret = ntb_mw_get_align(inmw->tc->ntb, inmw->pidx, inmw->widx,
> &addr_align, &size_align, &size_max);
> if (ret)
> - return ret;
> + goto err;
>
> off += scnprintf(buf + off, buf_size - off,
> "Inbound MW \t%d\n",
> @@ -694,6 +694,8 @@ static ssize_t tool_mw_trans_read(struct file *filep, char __user *ubuf,
> &size_max);
>
> ret = simple_read_from_buffer(ubuf, size, offp, buf, off);
> +
> +err:
> kfree(buf);
>
> return ret;
> --
> 2.15.1
>

2018-01-24 04:08:59

by Jon Mason

Subject: Re: [PATCH][next] NTB: ntb_tool: fix memory leak on 'buf' on error exit path

On Mon, Jan 22, 2018 at 01:02:39PM +0300, Serge Semin wrote:
> On Mon, Jan 22, 2018 at 09:38:57AM +0000, Colin King <[email protected]> wrote:
> > From: Colin Ian King <[email protected]>
> >
> > Currently there is a memory leak on buf when the call to ntb_mw_get_align
> > fails. Add an exit err label and jump to this so that kfree on buf frees
> > the memory.
> >
> > Detected by CoverityScan, CID#1464286 ("Resource leak")
> >
> > Fixes: d637628ce00c ("NTB: ntb_tool: Add full multi-port NTB API support")
> > Signed-off-by: Colin Ian King <[email protected]>
>
> Good catch, thanks!
>
> Acked-by: Serge Semin <[email protected]>

Applied to ntb-next

Thanks,
Jon

>
> > ---
> > drivers/ntb/test/ntb_tool.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
> > index 920fc9b161b0..d592c0ffbd19 100644
> > --- a/drivers/ntb/test/ntb_tool.c
> > +++ b/drivers/ntb/test/ntb_tool.c
> > @@ -659,7 +659,7 @@ static ssize_t tool_mw_trans_read(struct file *filep, char __user *ubuf,
> > ret = ntb_mw_get_align(inmw->tc->ntb, inmw->pidx, inmw->widx,
> > &addr_align, &size_align, &size_max);
> > if (ret)
> > - return ret;
> > + goto err;
> >
> > off += scnprintf(buf + off, buf_size - off,
> > "Inbound MW \t%d\n",
> > @@ -694,6 +694,8 @@ static ssize_t tool_mw_trans_read(struct file *filep, char __user *ubuf,
> > &size_max);
> >
> > ret = simple_read_from_buffer(ubuf, size, offp, buf, off);
> > +
> > +err:
> > kfree(buf);
> >
> > return ret;
> > --
> > 2.15.1
> >