linux-kernel - [PATCH][QUESTION] Intentional memory leak in ipmi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160219064132.GA2859126@devbig337.prn1.facebook.com>
Date:	Thu, 18 Feb 2016 22:41:32 -0800
From:	Calvin Owens <calvinowens@...com>
To:	<minyard@....org>, <openipmi-developer@...ts.sourceforge.net>
CC:	<linux-kernel@...r.kernel.org>, <kernel-team@...com>
Subject: [PATCH][QUESTION] Intentional memory leak in ipmi_msghandler?

Hello,

I've got a few boxes that are leaking memory in handle_new_recv_msgs()
in ipmi_msghandler. AFAICS this is intentional, there's even an explicit
counter that tracks the number of times smi_msg is leaked.

I'm guessing there was a reason for doing this, but there wasn't any
discussion about it on LKML when the patch was accepted. Can you clarify
why something like the below patch won't work? I tried it on one of my
leaky boxes and nothing obviously horrible happened.

Thanks,
Calvin

----8<----
From: Calvin Owens <calvinowens@...com>
Subject: [PATCH] ipmi_msghandler: Don't leak memory on errors

Signed-off-by: Calvin Owens <calvinowens@...com>
---
 drivers/char/ipmi/ipmi_msghandler.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 94fb407..ed82ffa 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3834,10 +3834,7 @@ static void handle_new_recv_msgs(ipmi_smi_t intf)
 			break;
 		} else {
 			list_del(&smi_msg->link);
-			if (rv == 0)
-				/* Message handled */
-				ipmi_free_smi_msg(smi_msg);
-			/* If rv < 0, fatal error, del but don't free. */
+			ipmi_free_smi_msg(smi_msg);
 		}
 	}
 	if (!run_to_completion)
-- 
2.4.6