linux-kernel - [PATCH] lightnvm: pblk: fix bad free seq. on error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1494649795-569-1-git-send-email-javier@cnexlabs.com>
Date:   Sat, 13 May 2017 06:29:55 +0200
From:   "Javier González" <jg@...htnvm.io>
To:     mb@...htnvm.io, axboe@...com
Cc:     linux-block@...r.kernel.org, linux-kernel@...r.kernel.org,
        Javier González <javier@...xlabs.com>
Subject: [PATCH] lightnvm: pblk: fix bad free seq. on error path

Braces around the error patch for metadata pre-allocation are wrongly
placed. This causes a memory leak in case of a memory allocation
failure. Fix it

Signed-off-by: Javier González <javier@...xlabs.com>
---
 drivers/lightnvm/pblk-init.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/drivers/lightnvm/pblk-init.c b/drivers/lightnvm/pblk-init.c
index ae8cd6d5af8b..a2ee875aede3 100644
--- a/drivers/lightnvm/pblk-init.c
+++ b/drivers/lightnvm/pblk-init.c
@@ -604,12 +604,12 @@ static int pblk_lines_init(struct pblk *pblk)
 	l_mg->smeta_alloc_type = PBLK_KMALLOC_META;
 	for (i = 0; i < PBLK_DATA_LINES; i++) {
 		l_mg->sline_meta[i].meta = kmalloc(lm->smeta_len, GFP_KERNEL);
-		if (!l_mg->sline_meta[i].meta)
-			while (--i >= 0) {
+		if (!l_mg->sline_meta[i].meta) {
+			while (--i >= 0)
 				kfree(l_mg->sline_meta[i].meta);
-				ret = -ENOMEM;
-				goto fail;
-			}
+			ret = -ENOMEM;
+			goto fail;
+		}
 	}
 
 	if (lm->emeta_len > KMALLOC_MAX_CACHE_SIZE) {
@@ -617,12 +617,12 @@ static int pblk_lines_init(struct pblk *pblk)
 
 		for (i = 0; i < PBLK_DATA_LINES; i++) {
 			l_mg->eline_meta[i].meta = vmalloc(lm->emeta_len);
-			if (!l_mg->eline_meta[i].meta)
-				while (--i >= 0) {
+			if (!l_mg->eline_meta[i].meta) {
+				while (--i >= 0)
 					vfree(l_mg->eline_meta[i].meta);
-					ret = -ENOMEM;
-					goto fail;
-				}
+				ret = -ENOMEM;
+				goto fail_free_meta;
+			}
 		}
 	} else {
 		l_mg->emeta_alloc_type = PBLK_KMALLOC_META;
@@ -630,12 +630,12 @@ static int pblk_lines_init(struct pblk *pblk)
 		for (i = 0; i < PBLK_DATA_LINES; i++) {
 			l_mg->eline_meta[i].meta =
 					kmalloc(lm->emeta_len, GFP_KERNEL);
-			if (!l_mg->eline_meta[i].meta)
-				while (--i >= 0) {
+			if (!l_mg->eline_meta[i].meta) {
+				while (--i >= 0)
 					kfree(l_mg->eline_meta[i].meta);
-					ret = -ENOMEM;
-					goto fail;
-				}
+				ret = -ENOMEM;
+				goto fail_free_meta;
+			}
 		}
 	}
 
-- 
2.7.4