linux-kernel - Re: [PATCH] target: Fix memory leak in fd_set_configfs_dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1295218456.22813.61.camel@haakon2.linux-iscsi.org>
Date:	Sun, 16 Jan 2011 14:54:16 -0800
From:	"Nicholas A. Bellinger" <nab@...ux-iscsi.org>
To:	Jesper Juhl <jj@...osbits.net>
Cc:	linux-kernel@...r.kernel.org,
	James Bottomley <James.Bottomley@...e.de>
Subject: Re: [PATCH] target: Fix memory leak in
	fd_set_configfs_dev_params().

On Sun, 2011-01-16 at 20:17 +0100, Jesper Juhl wrote:
> match_strdup() dynamically allocates memory and it is the responsabillity 
> of the caller to free that memory. In 
> drivers/target/target_core_file.c::fd_set_configfs_dev_params() two calls 
> are made to match_strdup() and in neither case is the allocated memory 
> freed, but instead it is leaked.
> 
> This patch should take care of the problem by kfree()'ing the allocated 
> memory once it is no longer needed. It also makes sure to return -ENOMEM 
> if the memory allocation in match_strdup() should fail.
> 
> Please review and consider for inclusion.
> 
> Signed-off-by: Jesper Juhl <jj@...osbits.net>

Ugh, this was my fault during the recent v4.0 configfs parameter
conversion.  Committed as 5c45b37 in lio-core-2.6.git/linus-38-rc1 and I
will fix up the other handful of match_strdup() breakage and carry into
scsi-post-merge-2.6.git/for-jejb shortly.

Thanks for catching this..

--nab

> ---
>  target_core_file.c |   13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
>   compile tested only.
> 
> diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
> index 0aaca88..676a010 100644
> --- a/drivers/target/target_core_file.c
> +++ b/drivers/target/target_core_file.c
> @@ -537,15 +537,26 @@ static ssize_t fd_set_configfs_dev_params(
>  		token = match_token(ptr, tokens, args);
>  		switch (token) {
>  		case Opt_fd_dev_name:
> +			arg_p = match_strdup(&args[0]);
> +			if (!arg_p) {
> +				ret = -ENOMEM;
> +				break;
> +			}
>  			snprintf(fd_dev->fd_dev_name, FD_MAX_DEV_NAME,
> -					"%s", match_strdup(&args[0]));
> +					"%s", arg_p);
> +			kfree(arg_p);
>  			printk(KERN_INFO "FILEIO: Referencing Path: %s\n",
>  					fd_dev->fd_dev_name);
>  			fd_dev->fbd_flags |= FBDF_HAS_PATH;
>  			break;
>  		case Opt_fd_dev_size:
>  			arg_p = match_strdup(&args[0]);
> +			if (!arg_p) {
> +				ret = -ENOMEM;
> +				break;
> +			}
>  			ret = strict_strtoull(arg_p, 0, &fd_dev->fd_dev_size);
> +			kfree(arg_p);
>  			if (ret < 0) {
>  				printk(KERN_ERR "strict_strtoull() failed for"
>  						" fd_dev_size=\n");
> 
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/