2015-11-23 10:35:25

by Sudip Mukherjee

Subject: [PATCH] lightnvm: fix memory leak

If copy_to_user() fails we returned error but we missed releasing
devices.

Signed-off-by: Sudip Mukherjee <[email protected]>
---
drivers/lightnvm/core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index f659e60..6688b60 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -721,8 +721,11 @@ static long nvm_ioctl_get_devices(struct file *file, void __user *arg)

devices->nr_devices = i;

- if (copy_to_user(arg, devices, sizeof(struct nvm_ioctl_get_devices)))
+ if (copy_to_user(arg, devices,
+ sizeof(struct nvm_ioctl_get_devices))) {
+ kfree(devices);
return -EFAULT;
+ }

kfree(devices);
return 0;
--
1.9.1

2015-11-23 15:13:50

by Matias Bjørling

Subject: Re: [PATCH] lightnvm: fix memory leak

On 11/23/2015 11:35 AM, Sudip Mukherjee wrote:
> If copy_to_user() fails we returned error but we missed releasing
> devices.
>
> Signed-off-by: Sudip Mukherjee <[email protected]>
> ---
> drivers/lightnvm/core.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
> index f659e60..6688b60 100644
> --- a/drivers/lightnvm/core.c
> +++ b/drivers/lightnvm/core.c
> @@ -721,8 +721,11 @@ static long nvm_ioctl_get_devices(struct file *file, void __user *arg)
>
> devices->nr_devices = i;
>
> - if (copy_to_user(arg, devices, sizeof(struct nvm_ioctl_get_devices)))
> + if (copy_to_user(arg, devices,
> + sizeof(struct nvm_ioctl_get_devices))) {
> + kfree(devices);
> return -EFAULT;
> + }
>
> kfree(devices);
> return 0;
>

Thanks Sudip, it seems like this error is in some of the others ioctl's
as well. Do you want to send a patch with the fixes for them all?

2015-11-23 16:40:17

by Sudip Mukherjee

Subject: Re: [PATCH] lightnvm: fix memory leak

On Mon, Nov 23, 2015 at 04:13:39PM +0100, Matias Bj?rling wrote:
> On 11/23/2015 11:35 AM, Sudip Mukherjee wrote:
> >If copy_to_user() fails we returned error but we missed releasing
> >devices.
> >
> >Signed-off-by: Sudip Mukherjee <[email protected]>
> >---
> > drivers/lightnvm/core.c | 5 ++++-
> > 1 file changed, 4 insertions(+), 1 deletion(-)
> >
> >diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
> >index f659e60..6688b60 100644
> >--- a/drivers/lightnvm/core.c
> >+++ b/drivers/lightnvm/core.c
> >@@ -721,8 +721,11 @@ static long nvm_ioctl_get_devices(struct file *file, void __user *arg)
> >
> > devices->nr_devices = i;
> >
> >- if (copy_to_user(arg, devices, sizeof(struct nvm_ioctl_get_devices)))
> >+ if (copy_to_user(arg, devices,
> >+ sizeof(struct nvm_ioctl_get_devices))) {
> >+ kfree(devices);
> > return -EFAULT;
> >+ }
> >
> > kfree(devices);
> > return 0;
> >
>
> Thanks Sudip, it seems like this error is in some of the others
> ioctl's as well. Do you want to send a patch with the fixes for them
> all?

I can find a similar error in nvm_ioctl_info(). I will have a close look
tomorrow and send a patch. Is this patch applied or should I send a
combined patch fixing all these similar errors?

regards
sudip

2015-11-23 18:41:50

by Matias Bjørling

Subject: Re: [PATCH] lightnvm: fix memory leak

On 11/23/2015 05:40 PM, Sudip Mukherjee wrote:
> On Mon, Nov 23, 2015 at 04:13:39PM +0100, Matias Bj?rling wrote:
>> On 11/23/2015 11:35 AM, Sudip Mukherjee wrote:
>>> If copy_to_user() fails we returned error but we missed releasing
>>> devices.
>>>
>>> Signed-off-by: Sudip Mukherjee <[email protected]>
>>> ---
>>> drivers/lightnvm/core.c | 5 ++++-
>>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
>>> index f659e60..6688b60 100644
>>> --- a/drivers/lightnvm/core.c
>>> +++ b/drivers/lightnvm/core.c
>>> @@ -721,8 +721,11 @@ static long nvm_ioctl_get_devices(struct file *file, void __user *arg)
>>>
>>> devices->nr_devices = i;
>>>
>>> - if (copy_to_user(arg, devices, sizeof(struct nvm_ioctl_get_devices)))
>>> + if (copy_to_user(arg, devices,
>>> + sizeof(struct nvm_ioctl_get_devices))) {
>>> + kfree(devices);
>>> return -EFAULT;
>>> + }
>>>
>>> kfree(devices);
>>> return 0;
>>>
>>
>> Thanks Sudip, it seems like this error is in some of the others
>> ioctl's as well. Do you want to send a patch with the fixes for them
>> all?

Sure, That'll be great. Then I'll apply it.

>
> I can find a similar error in nvm_ioctl_info(). I will have a close look
> tomorrow and send a patch. Is this patch applied or should I send a
> combined patch fixing all these similar errors?

A combined will be great. It fixes the same type of error. Thank you.