linux-kernel - [PATCH] target: Fix memory leak in fd_set_configfs_dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

[an error occurred while processing this directive]

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1101162006410.13377@swampdragon.chaosbits.net>
Date:	Sun, 16 Jan 2011 20:17:25 +0100 (CET)
From:	Jesper Juhl <jj@...osbits.net>
To:	linux-kernel@...r.kernel.org
cc:	James Bottomley <James.Bottomley@...e.de>,
	"Nicholas A. Bellinger" <nab@...ux-iscsi.org>
Subject: [PATCH] target: Fix memory leak in fd_set_configfs_dev_params().

match_strdup() dynamically allocates memory and it is the responsabillity 
of the caller to free that memory. In 
drivers/target/target_core_file.c::fd_set_configfs_dev_params() two calls 
are made to match_strdup() and in neither case is the allocated memory 
freed, but instead it is leaked.

This patch should take care of the problem by kfree()'ing the allocated 
memory once it is no longer needed. It also makes sure to return -ENOMEM 
if the memory allocation in match_strdup() should fail.

Please review and consider for inclusion.

Signed-off-by: Jesper Juhl <jj@...osbits.net>
---
 target_core_file.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

  compile tested only.

diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 0aaca88..676a010 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -537,15 +537,26 @@ static ssize_t fd_set_configfs_dev_params(
 		token = match_token(ptr, tokens, args);
 		switch (token) {
 		case Opt_fd_dev_name:
+			arg_p = match_strdup(&args[0]);
+			if (!arg_p) {
+				ret = -ENOMEM;
+				break;
+			}
 			snprintf(fd_dev->fd_dev_name, FD_MAX_DEV_NAME,
-					"%s", match_strdup(&args[0]));
+					"%s", arg_p);
+			kfree(arg_p);
 			printk(KERN_INFO "FILEIO: Referencing Path: %s\n",
 					fd_dev->fd_dev_name);
 			fd_dev->fbd_flags |= FBDF_HAS_PATH;
 			break;
 		case Opt_fd_dev_size:
 			arg_p = match_strdup(&args[0]);
+			if (!arg_p) {
+				ret = -ENOMEM;
+				break;
+			}
 			ret = strict_strtoull(arg_p, 0, &fd_dev->fd_dev_size);
+			kfree(arg_p);
 			if (ret < 0) {
 				printk(KERN_ERR "strict_strtoull() failed for"
 						" fd_dev_size=\n");


-- 
Jesper Juhl <jj@...osbits.net>            http://www.chaosbits.net/
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/