linux-kernel - [PATCH][rfc] md: Close mem leak in userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 14 Dec 2010 00:40:04 +0100 (CET)
From:	Jesper Juhl <jj@...osbits.net>
To:	linux-kernel@...r.kernel.org
cc:	linux-raid@...r.kernel.org, dm-devel@...hat.com,
	Neil Brown <neilb@...e.de>
Subject: [PATCH][rfc] md: Close mem leak in userspace_ctr()

Hi,

There's a small memory leak in 
drivers/md/dm-log-userspace-base.c::userspace_ctr().

The call to build_constructor_string() dynamically allocates memory for 
its last argument, but we do not always clean up that allocated memory.
The patch below closes the leak and also removes some unneeded local 
variables and some pointless assignments.

If the patch looks good, please consider applying it - if not, please tell 
me where I messed up.

Signed-off-by: Jesper Juhl <jj@...osbits.net>
---
 dm-log-userspace-base.c |   15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

 Compile tested only.

diff --git a/drivers/md/dm-log-userspace-base.c b/drivers/md/dm-log-userspace-base.c
index 1ed0094..71a3049 100644
--- a/drivers/md/dm-log-userspace-base.c
+++ b/drivers/md/dm-log-userspace-base.c
@@ -99,26 +99,22 @@ static int build_constructor_string(struct dm_target *ti,
 				    char **ctr_str)
 {
 	int i, str_size;
-	char *str = NULL;
-
-	*ctr_str = NULL;
 
 	for (i = 0, str_size = 0; i < argc; i++)
 		str_size += strlen(argv[i]) + 1; /* +1 for space between args */
 
 	str_size += 20; /* Max number of chars in a printed u64 number */
 
-	str = kzalloc(str_size, GFP_KERNEL);
-	if (!str) {
+	*ctr_str = kzalloc(str_size, GFP_KERNEL);
+	if (!*ctr_str) {
 		DMWARN("Unable to allocate memory for constructor string");
 		return -ENOMEM;
 	}
 
-	str_size = sprintf(str, "%llu", (unsigned long long)ti->len);
+	str_size = sprintf(*ctr_str, "%llu", (unsigned long long)ti->len);
 	for (i = 0; i < argc; i++)
-		str_size += sprintf(str + str_size, " %s", argv[i]);
+		str_size += sprintf(*ctr_str + str_size, " %s", argv[i]);
 
-	*ctr_str = str;
 	return str_size;
 }
 
@@ -140,7 +136,7 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
 {
 	int r = 0;
 	int str_size;
-	char *ctr_str = NULL;
+	char *ctr_str;
 	struct log_c *lc = NULL;
 	uint64_t rdata;
 	size_t rdata_size = sizeof(rdata);
@@ -173,6 +169,7 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
 
 	str_size = build_constructor_string(ti, argc - 1, argv + 1, &ctr_str);
 	if (str_size < 0) {
+		kfree(ctr_str);
 		kfree(lc);
 		return str_size;
 	}



-- 
Jesper Juhl <jj@...osbits.net>            http://www.chaosbits.net/
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/