Skip to contentSkip to conversation

fs/cifs/cifs_dfs_ref.c: fix potential memory leakage

PATCH Applied Cong Ding 3 participants 4 messages Jan 23, 2013

Subsystems (2)
SMB client (CIFS) Kernel SMB3 server (ksmbd)
lore
Share & tools
lore

Cong Ding

author
#0 lore raw

PATCH 1/1 fs/cifs/cifs_dfs_ref.c: fix potential memory leakage

When it goes to error through line 144, the memory allocated to *devname is not freed, and the caller doesn't free it either in line 250. So we free the memroy of *devname in function cifs_compose_mount_options() when it goes to error.

Signed-off-by Cong Ding <[email protected]>
---
 fs/cifs/cifs_dfs_ref.c |    2 ++
 1 file changed, 2 insertions(+)
fs/cifs/cifs_dfs_ref.c +2 -0
index ce5cbd7..210fce2 100644
@@ -226,6 +226,8 @@ compose_mount_options_out:
 compose_mount_options_err:
 	kfree(mountdata);
 	mountdata = ERR_PTR(rc);
+	kfree(*devname);
+	*devname = NULL;
 	goto compose_mount_options_out;
 }
Signature · 1 line
1.7.10.4
Reviewed-by on v1 1/1
#1 lore raw
Quoted 15 lines · On Tue, 22 Jan 2013 19:20:58 -0500 Cong Ding…

When it goes to error through line 144, the memory allocated to *devname is not freed, and the caller doesn't free it either in line 250. So we free the memroy of *devname in function cifs_compose_mount_options() when it goes to error.

Signed-off-by Cong Ding <[email protected]>
---
 fs/cifs/cifs_dfs_ref.c |    2 ++
 1 file changed, 2 insertions(+)
fs/cifs/cifs_dfs_ref.c +0 -0
index ce5cbd7..210fce2 100644

fs/cifs/cifs_dfs_ref.c compose_mount_options_out: · line 233

Quoted 8 lines
fs/cifs/cifs_dfs_ref.c +2 -0
@@ -226,6 +226,8 @@ compose_mount_options_out:
 compose_mount_options_err:
 	kfree(mountdata);
 	mountdata = ERR_PTR(rc);
+	kfree(*devname);
+	*devname = NULL;
 	goto compose_mount_options_out;
 }

Nice catch. Looks correct to me. Should this also go to stable?

Reviewed-by Jeff Layton <[email protected]>
Applied
#2 lore raw

merged into cifs-2.6.git

Quoted 30 lines · Jeff Layton
Quoted 15 lines · On Tue, 22 Jan 2013 19:20:58 -0500 Cong Ding…

When it goes to error through line 144, the memory allocated to *devname is not freed, and the caller doesn't free it either in line 250. So we free the memroy of *devname in function cifs_compose_mount_options() when it goes to error.

Signed-off-by Cong Ding <[email protected]>
---
 fs/cifs/cifs_dfs_ref.c |    2 ++
 1 file changed, 2 insertions(+)
fs/cifs/cifs_dfs_ref.c +0 -0
index ce5cbd7..210fce2 100644

fs/cifs/cifs_dfs_ref.c compose_mount_options_out: · line 233

Quoted 8 lines
fs/cifs/cifs_dfs_ref.c +2 -0
@@ -226,6 +226,8 @@ compose_mount_options_out:
 compose_mount_options_err:
      kfree(mountdata);
      mountdata = ERR_PTR(rc);
+     kfree(*devname);
+     *devname = NULL;
      goto compose_mount_options_out;
 }

Nice catch. Looks correct to me. Should this also go to stable?

Reviewed-by Jeff Layton <[email protected]>
Signature · 3 lines
Thanks,

Steve