linux-kernel - Re: [PATCH] drm/vmwgfx: fix memory leak when too many retries have occurred

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7b8430b3809eff2341d3e82c398038c1a9a0cc06.camel@vmware.com>
Date:   Mon, 24 Jun 2019 16:10:49 +0000
From:   Deepak Singh Rawat <drawat@...are.com>
To:     Colin King <colin.king@...onical.com>,
        Linux-graphics-maintainer <Linux-graphics-maintainer@...are.com>,
        Thomas Hellstrom <thellstrom@...are.com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>
CC:     "kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] drm/vmwgfx: fix memory leak when too many retries have
 occurred

Hi Colin,

Thanks for doing this.

Reviewed-by: Deepak Rawat <drawat@...are.com>

Do you want me to include this in vmwgfx-next or will you submit this
via drm-mics?

On Fri, 2019-06-21 at 23:35 +0100, Colin King wrote:
> From: Colin Ian King <colin.king@...onical.com>
> 
> Currently when too many retries have occurred there is a memory
> leak on the allocation for reply on the error return path. Fix
> this by kfree'ing reply before returning.
> 
> Addresses-Coverity: ("Resource leak")
> Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message
> failure")
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> index 8b9270f31409..8b61f16f50cf 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> @@ -301,8 +301,10 @@ static int vmw_recv_msg(struct rpc_channel
> *channel, void **msg,
>  		break;
>  	}
>  
> -	if (retries == RETRIES)
> +	if (retries == RETRIES) {
> +		kfree(reply);
>  		return -EINVAL;
> +	}
>  
>  	*msg_len = reply_len;
>  	*msg     = reply;