The following pull request was submitted through Github.
It can be accessed and reviewed at: https://github.com/lxc/lxcfs/pull/241

This e-mail was sent by the LXC bot, direct replies will not reach the author
unless they happen to be subscribed to this list.

=== Description (from pull-request) ===
In `proc_loadavg_read()`, `cg` is allocated by`get_pid_cgroup()`, but it's not freed before returning.
From 01d88ede4746a7ef08f38ce779799e4a9ddef105 Mon Sep 17 00:00:00 2001
From: Jakub Skokan <[email protected]>
Date: Mon, 11 Jun 2018 15:12:22 +0200
Subject: [PATCH] bindings: fix memory leak in proc_loadavg_read()

Signed-off-by: Jakub Skokan <[email protected]>
---
 bindings.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/bindings.c b/bindings.c
index b20eaa0..f7d3194 100644
--- a/bindings.c
+++ b/bindings.c
@@ -4552,7 +4552,7 @@ static int proc_loadavg_read(char *buf, size_t size, 
off_t offset,
        char *cache = d->buf;
        struct load_node *n;
        int hash;
-       int cfd;
+       int cfd, rv = 0;
        unsigned long a, b, c;
 
        if (offset) {
@@ -4587,7 +4587,8 @@ static int proc_loadavg_read(char *buf, size_t size, 
off_t offset,
                         * because delete is not allowed before read has ended.
                         */
                        pthread_rwlock_unlock(&load_hash[hash].rdlock);
-                       return 0;
+                       rv = 0;
+                       goto err;
                }
                do {
                        n = malloc(sizeof(struct load_node));
@@ -4617,7 +4618,8 @@ static int proc_loadavg_read(char *buf, size_t size, 
off_t offset,
        pthread_rwlock_unlock(&load_hash[hash].rdlock);
        if (total_len < 0 || total_len >=  d->buflen) {
                lxcfs_error("%s\n", "Failed to write to cache");
-               return 0;
+               rv = 0;
+               goto err;
        }
        d->size = (int)total_len;
        d->cached = 1;
@@ -4625,7 +4627,11 @@ static int proc_loadavg_read(char *buf, size_t size, 
off_t offset,
        if (total_len > size)
                total_len = size;
        memcpy(buf, d->buf, total_len);
-       return total_len;
+       rv = total_len;
+
+err:
+       free(cg);
+       return rv;
 }
 /* Return a positive number on success, return 0 on failure.*/
 pthread_t load_daemon(int load_use)
_______________________________________________
lxc-devel mailing list
[email protected]
http://lists.linuxcontainers.org/listinfo/lxc-devel

Reply via email to