linux-kernel - Re: [PATCH] lightnvm: prevent memory leak in nvm_bb_chunk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <8FE3FFB7-4FF5-4BF5-B95E-2FECC003702D@javigon.com>
Date:   Mon, 30 Sep 2019 10:06:38 +0200
From:   Javier González <javier@...igon.com>
To:     Navid Emamdoost <navid.emamdoost@...il.com>
Cc:     emamd001@....edu, smccaman@....edu, kjlu@....edu,
        Matias Bjørling <mb@...htnvm.io>,
        linux-block@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] lightnvm: prevent memory leak in nvm_bb_chunk_sense

> On 30 Sep 2019, at 04.34, Navid Emamdoost <navid.emamdoost@...il.com> wrote:
> 
> In nvm_bb_chunk_sense alloc_page allocates memory which is released at
> the end of the function. But if nvm_submit_io_sync_raw fails the error
> check skips the release and leaks the allocated page. To fix this issue
> I moved the __free_page call before error check.
> 
> Fixes: aff3fb18f957 ("lightnvm: move bad block and chunk state logic to core")
> Signed-off-by: Navid Emamdoost <navid.emamdoost@...il.com>
> ---
> drivers/lightnvm/core.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
> index 7543e395a2c6..5fdae518f6c9 100644
> --- a/drivers/lightnvm/core.c
> +++ b/drivers/lightnvm/core.c
> @@ -849,11 +849,12 @@ static int nvm_bb_chunk_sense(struct nvm_dev *dev, struct ppa_addr ppa)
> 	rqd.ppa_addr = generic_to_dev_addr(dev, ppa);
> 
> 	ret = nvm_submit_io_sync_raw(dev, &rqd);
> -	if (ret)
> -		return ret;
> 
> 	__free_page(page);
> 
> +	if (ret)
> +		return ret;
> +
> 	return rqd.error;
> }
> 
> --
> 2.17.1

You’re right, there is a leak here. Fix looks good to me.

Reviewed-by: Javier González <javier@...igon.com>


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)