cg_control() returns a path allocated with malloc(). The two callers
that pass it straight to inotify_add_watch() never free it, and pass
NULL to it if the allocation fails.

Keep the path in a local variable, check it, and free it when done.

Fixes: 5313bfe425c8a ("kselftests: cgroup: add freezer controller self-tests")
Fixes: 2de27980e1d46 ("selftests: memcg: Add tests for IN_DELETE_SELF and 
IN_IGNORED")
Assisted-by: LLM
Signed-off-by: Sasha Levin <[email protected]>
---
 tools/testing/selftests/cgroup/lib/cgroup_util.c | 13 ++++++++++---
 tools/testing/selftests/cgroup/test_memcontrol.c |  9 +++++++--
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/cgroup/lib/cgroup_util.c 
b/tools/testing/selftests/cgroup/lib/cgroup_util.c
index 2596c12cd8645..ed99a235e76e1 100644
--- a/tools/testing/selftests/cgroup/lib/cgroup_util.c
+++ b/tools/testing/selftests/cgroup/lib/cgroup_util.c
@@ -626,18 +626,25 @@ int clone_into_cgroup_run_wait(const char *cgroup)
 
 static int __prepare_for_wait(const char *cgroup, const char *filename)
 {
-       int fd, ret = -1;
+       char *path;
+       int fd, ret;
+
+       path = cg_control(cgroup, filename);
+       if (!path)
+               return -1;
 
        fd = inotify_init1(0);
        if (fd == -1)
-               return fd;
+               goto out;
 
-       ret = inotify_add_watch(fd, cg_control(cgroup, filename), IN_MODIFY);
+       ret = inotify_add_watch(fd, path, IN_MODIFY);
        if (ret == -1) {
                close(fd);
                fd = -1;
        }
 
+out:
+       free(path);
        return fd;
 }
 
diff --git a/tools/testing/selftests/cgroup/test_memcontrol.c 
b/tools/testing/selftests/cgroup/test_memcontrol.c
index 047d487f6dd57..7bcf772bcea2d 100644
--- a/tools/testing/selftests/cgroup/test_memcontrol.c
+++ b/tools/testing/selftests/cgroup/test_memcontrol.c
@@ -1677,7 +1677,7 @@ static int read_event(int inotify_fd, int expected_event, 
int expected_wd)
 static int test_memcg_inotify_delete_file(const char *root)
 {
        int ret = KSFT_FAIL;
-       char *memcg = NULL;
+       char *memcg = NULL, *events = NULL;
        int fd = -1, wd;
 
        memcg = cg_name(root, "memcg_test_0");
@@ -1692,7 +1692,11 @@ static int test_memcg_inotify_delete_file(const char 
*root)
        if (fd == -1)
                goto cleanup;
 
-       wd = inotify_add_watch(fd, cg_control(memcg, "memory.events"), 
IN_DELETE_SELF);
+       events = cg_control(memcg, "memory.events");
+       if (!events)
+               goto cleanup;
+
+       wd = inotify_add_watch(fd, events, IN_DELETE_SELF);
        if (wd == -1)
                goto cleanup;
 
@@ -1714,6 +1718,7 @@ static int test_memcg_inotify_delete_file(const char 
*root)
                close(fd);
        if (memcg)
                cg_destroy(memcg);
+       free(events);
        free(memcg);
 
        return ret;
-- 
2.53.0


Reply via email to