linux-kernel - Re: [PATCH] vfio: fix potential memory leak in vfio_msi_cap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Sep 2018 19:00:17 +0200
From:   Auger Eric <eric.auger@...hat.com>
To:     David Hildenbrand <david@...hat.com>, Li Qiang <liq3ea@...il.com>,
        alex.williamson@...hat.com
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        liqiang02@...p.netease.com
Subject: Re: [PATCH] vfio: fix potential memory leak in vfio_msi_cap_len

Hi Li, David,

On 08/30/2018 04:15 PM, David Hildenbrand wrote:
> On 27.08.2018 14:47, Li Qiang wrote:
>> Free the vdev->msi_perm in error path.
>>
>> Signed-off-by: Li Qiang <liq3ea@...il.com>
>> ---
>>  drivers/vfio/pci/vfio_pci_config.c | 4 +++-
>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
>> index 115a36f6f403..62023b4a373b 100644
>> --- a/drivers/vfio/pci/vfio_pci_config.c
>> +++ b/drivers/vfio/pci/vfio_pci_config.c
>> @@ -1180,8 +1180,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
>>  		return -ENOMEM;
>>  
>>  	ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
>> -	if (ret)
>> +	if (ret) {
>> +		kfree(vdev->msi_perm);
>>  		return ret;
>> +	}
>>  
>>  	return len;
>>  }
>>
> 
> Doesn't vfio_config_free() take care of that in all cases?

Looks OK to me.
Reviewed-by: Eric Auger <eric.auger@...hat.com>

Looks vfio_config_free is called on vfio_pci_release whereas
vfio_msi_cap_len can fail in vfio_pci_open path.

Thanks

Eric
>