linux-kernel - [PATCH] blk-mq: fix a memory leak bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1563087801-7373-1-git-send-email-wang6495@umn.edu>
Date:   Sun, 14 Jul 2019 02:03:21 -0500
From:   Wenwen Wang <wang6495@....edu>
To:     Wenwen Wang <wenwen@...uga.edu>
Cc:     Jens Axboe <axboe@...nel.dk>,
        linux-block@...r.kernel.org (open list:BLOCK LAYER),
        linux-kernel@...r.kernel.org (open list)
Subject: [PATCH] blk-mq: fix a memory leak bug

From: Wenwen Wang <wenwen@...uga.edu>

In blk_mq_init_allocated_queue(), a kernel buffer is allocated through
kcalloc_node() to hold hardware dispatch queues in the request queue 'q',
i.e., 'q->queue_hw_ctx'.  Later on, if the blk-mq device has no scheduler
set, a scheduler will be initialized through elevator_init_mq(). If this
initialization fails, blk_mq_init_allocated_queue() needs to be terminated
with an error code returned to indicate this failure. However, the
allocated buffer is not freed on this execution path, leading to a memory
leak bug. Moreover, the required cleanup work is also missed on this path.

To fix the above issues, free the allocated buffer and invoke the cleanup
functions.

Signed-off-by: Wenwen Wang <wenwen@...uga.edu>
---
 block/blk-mq.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index e5ef40c..04fe077 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2845,6 +2845,8 @@ static unsigned int nr_hw_queues(struct blk_mq_tag_set *set)
 struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
 						  struct request_queue *q)
 {
+	int ret = -ENOMEM;
+
 	/* mark the queue as mq asap */
 	q->mq_ops = set->ops;

@@ -2906,11 +2908,9 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
 	blk_mq_map_swqueue(q);

 	if (!(set->flags & BLK_MQ_F_NO_SCHED)) {
-		int ret;
-
 		ret = elevator_init_mq(q);
 		if (ret)
-			return ERR_PTR(ret);
+			goto err_hctxs;
 	}

 	return q;
@@ -2924,7 +2924,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
 	q->poll_cb = NULL;
 err_exit:
 	q->mq_ops = NULL;
-	return ERR_PTR(-ENOMEM);
+	return ERR_PTR(ret);
 }
 EXPORT_SYMBOL(blk_mq_init_allocated_queue);

-- 
2.7.4