linux-kernel - [PATCH] vfs: samples: fix memory leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20200809170636.22133-1-trix@redhat.com>
Date:   Sun,  9 Aug 2020 10:06:36 -0700
From:   trix@...hat.com
To:     dhowells@...hat.com, jlayton@...nel.org
Cc:     linux-kernel@...r.kernel.org, Tom Rix <trix@...hat.com>
Subject: [PATCH] vfs: samples: fix memory leak

From: Tom Rix <trix@...hat.com>

clang static analysis reports this represenative problem

test-fsinfo.c:615:3: warning: Potential leak of memory pointed to by 'r'
                memset(r, 0xbd, buf_size);
                ^~~~~~

r dynamically allocated in a loop an increasing size.

	for (;;) {
		r = malloc(buf_size);
...
		buf_size = (ret + 4096 - 1) & ~(4096 - 1);
	}

The problem is that r is never freed at the bottom of the loop.
So free r.

Signed-off-by: Tom Rix <trix@...hat.com>
---
 samples/vfs/test-fsinfo.c  | 1 +
 samples/vfs/test-mntinfo.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/samples/vfs/test-fsinfo.c b/samples/vfs/test-fsinfo.c
index aa122fb555b6..d669201d03ac 100644
--- a/samples/vfs/test-fsinfo.c
+++ b/samples/vfs/test-fsinfo.c
@@ -622,6 +622,7 @@ static ssize_t get_fsinfo(const char *file, const char *name,
 		if (ret <= buf_size - 1)
 			break;
 		buf_size = (ret + 4096 - 1) & ~(4096 - 1);
+		free(r);
 	}
 
 	if (debug)
diff --git a/samples/vfs/test-mntinfo.c b/samples/vfs/test-mntinfo.c
index 40125ad81f17..54a6abf4a8b0 100644
--- a/samples/vfs/test-mntinfo.c
+++ b/samples/vfs/test-mntinfo.c
@@ -105,6 +105,7 @@ static void *get_attr_alloc(unsigned int mnt_id, unsigned int attr,
 			break;
 		}
 		buf_size = (ret + 4096 - 1) & ~(4096 - 1);
+		free(r);
 	}
 
 	return r;
-- 
2.18.1