In fault_opcodes_read(), 'data' is not deallocated if debugfs_file_get()
fails, leading to a memory leak. To fix this bug, introduce the 'free_data'
label to free 'data' before returning the error.
Signed-off-by: Wenwen Wang <[email protected]>
---
drivers/infiniband/hw/hfi1/fault.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c
index 93613e5..814324d 100644
--- a/drivers/infiniband/hw/hfi1/fault.c
+++ b/drivers/infiniband/hw/hfi1/fault.c
@@ -214,7 +214,7 @@ static ssize_t fault_opcodes_read(struct file *file, char __user *buf,
return -ENOMEM;
ret = debugfs_file_get(file->f_path.dentry);
if (unlikely(ret))
- return ret;
+ goto free_data;
bit = find_first_bit(fault->opcodes, bitsize);
while (bit < bitsize) {
zero = find_next_zero_bit(fault->opcodes, bitsize, bit);
@@ -232,6 +232,7 @@ static ssize_t fault_opcodes_read(struct file *file, char __user *buf,
data[size - 1] = '\n';
data[size] = '\0';
ret = simple_read_from_buffer(buf, len, pos, data, size);
+free_data:
kfree(data);
return ret;
}
--
2.7.4
On Sun, Aug 18, 2019 at 02:29:31PM -0500, Wenwen Wang wrote:
> In fault_opcodes_read(), 'data' is not deallocated if debugfs_file_get()
> fails, leading to a memory leak. To fix this bug, introduce the 'free_data'
> label to free 'data' before returning the error.
>
> Signed-off-by: Wenwen Wang <[email protected]>
> ---
> drivers/infiniband/hw/hfi1/fault.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
Thanks,
Reviewed-by: Leon Romanovsky <[email protected]>
On 8/18/2019 3:29 PM, Wenwen Wang wrote:
> In fault_opcodes_read(), 'data' is not deallocated if debugfs_file_get()
> fails, leading to a memory leak. To fix this bug, introduce the 'free_data'
> label to free 'data' before returning the error.
>
> Signed-off-by: Wenwen Wang <[email protected]>
Acked-by: Dennis Dalessandro <[email protected]>
On Sun, 2019-08-18 at 14:29 -0500, Wenwen Wang wrote:
> In fault_opcodes_read(), 'data' is not deallocated if
> debugfs_file_get()
> fails, leading to a memory leak. To fix this bug, introduce the
> 'free_data'
> label to free 'data' before returning the error.
>
> Signed-off-by: Wenwen Wang <[email protected]>
Applied to for-rc, thanks.
--
Doug Ledford <[email protected]>
GPG KeyID: B826A3330E572FDD
Fingerprint = AE6B 1BDA 122B 23B4 265B 1274 B826 A333 0E57 2FDD