In fault_opcodes_write(), 'data' is allocated through kcalloc(). However,
it is not deallocated in the following execution if an error occurs,
leading to memory leaks. To fix this issue, introduce the 'free_data' label
to free 'data' before returning the error.
Signed-off-by: Wenwen Wang <[email protected]>
---
drivers/infiniband/hw/hfi1/fault.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c
index 93613e5..a999183 100644
--- a/drivers/infiniband/hw/hfi1/fault.c
+++ b/drivers/infiniband/hw/hfi1/fault.c
@@ -141,12 +141,14 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf,
if (!data)
return -ENOMEM;
copy = min(len, datalen - 1);
- if (copy_from_user(data, buf, copy))
- return -EFAULT;
+ if (copy_from_user(data, buf, copy)) {
+ ret = -EFAULT;
+ goto free_data;
+ }
ret = debugfs_file_get(file->f_path.dentry);
if (unlikely(ret))
- return ret;
+ goto free_data;
ptr = data;
token = ptr;
for (ptr = data; *ptr; ptr = end + 1, token = ptr) {
@@ -195,6 +197,7 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf,
ret = len;
debugfs_file_put(file->f_path.dentry);
+free_data:
kfree(data);
return ret;
}
--
2.7.4
On Sun, Aug 18, 2019 at 01:54:46PM -0500, Wenwen Wang wrote:
> In fault_opcodes_write(), 'data' is allocated through kcalloc(). However,
> it is not deallocated in the following execution if an error occurs,
> leading to memory leaks. To fix this issue, introduce the 'free_data' label
> to free 'data' before returning the error.
>
> Signed-off-by: Wenwen Wang <[email protected]>
> ---
> drivers/infiniband/hw/hfi1/fault.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
Thanks,
Reviewed-by: Leon Romanovsky <[email protected]>
On 8/18/2019 2:54 PM, Wenwen Wang wrote:
> In fault_opcodes_write(), 'data' is allocated through kcalloc(). However,
> it is not deallocated in the following execution if an error occurs,
> leading to memory leaks. To fix this issue, introduce the 'free_data' label
> to free 'data' before returning the error.
>
> Signed-off-by: Wenwen Wang <[email protected]>
Acked-by: Dennis Dalessandro <[email protected]>
On Sun, 2019-08-18 at 13:54 -0500, Wenwen Wang wrote:
> In fault_opcodes_write(), 'data' is allocated through kcalloc().
> However,
> it is not deallocated in the following execution if an error occurs,
> leading to memory leaks. To fix this issue, introduce the 'free_data'
> label
> to free 'data' before returning the error.
>
> Signed-off-by: Wenwen Wang <[email protected]>
Applied to for-rc, thanks.
--
Doug Ledford <[email protected]>
GPG KeyID: B826A3330E572FDD
Fingerprint = AE6B 1BDA 122B 23B4 265B 1274 B826 A333 0E57 2FDD