Re: [PATCH 1/4] Drivers: hv: utils: fix memory leak on on_msg() failure

[Dan Carpenter]

On Thu, Nov 12, 2015 at 12:32:13PM +0100, Vitaly Kuznetsov wrote:
> @@ -85,10 +86,10 @@ static ssize_t hvt_op_write(struct file *file, const char 
> __user *buf,
>   return PTR_ERR(inmsg);
>  
>   if (hvt->on_msg(inmsg, count))
> - return -EFAULT;
> + ret = -EFAULT;

You fix this leak and then re-introduce it again directly in patch 3/4.
Also it might be nice to preserve the error code.

ret = hvt->on_msg(inmsg, count);

kfree(inmsg);

return ret ? ret : count;

regards,
dan carpenter
___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Re: [PATCH 1/4] Drivers: hv: utils: fix memory leak on on_msg() failure

[Vitaly Kuznetsov]

Dan Carpenter  writes:

> On Thu, Nov 12, 2015 at 12:32:13PM +0100, Vitaly Kuznetsov wrote:
>> @@ -85,10 +86,10 @@ static ssize_t hvt_op_write(struct file *file, const 
>> char __user *buf,
>>  return PTR_ERR(inmsg);
>>  
>>  if (hvt->on_msg(inmsg, count))
>> -return -EFAULT;
>> +ret = -EFAULT;
>
> You fix this leak and then re-introduce it again directly in patch
> 3/4.

Such a shame ... Thanks for noticing!

> Also it might be nice to preserve the error code.
>
>   ret = hvt->on_msg(inmsg, count);
>
>   kfree(inmsg);
>
>   return ret ? ret : count;

It seems on_msg() hooks can only return -EINVAL now but why not
... let's do it in v2.

-- 
  Vitaly
___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH 1/4] Drivers: hv: utils: fix memory leak on on_msg() failure

[Vitaly Kuznetsov]

inmsg should be freed in case of on_msg() failure to avoid memory leak.

Signed-off-by: Vitaly Kuznetsov 
---
 drivers/hv/hv_utils_transport.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hv/hv_utils_transport.c b/drivers/hv/hv_utils_transport.c
index 24b2766..1d20451 100644
--- a/drivers/hv/hv_utils_transport.c
+++ b/drivers/hv/hv_utils_transport.c
@@ -77,6 +77,7 @@ static ssize_t hvt_op_write(struct file *file, const char 
__user *buf,
 {
struct hvutil_transport *hvt;
u8 *inmsg;
+   ssize_t ret = count;
 
hvt = container_of(file->f_op, struct hvutil_transport, fops);
 
@@ -85,10 +86,10 @@ static ssize_t hvt_op_write(struct file *file, const char 
__user *buf,
return PTR_ERR(inmsg);
 
if (hvt->on_msg(inmsg, count))
-   return -EFAULT;
+   ret = -EFAULT;
kfree(inmsg);
 
-   return count;
+   return ret;
 }
 
 static unsigned int hvt_op_poll(struct file *file, poll_table *wait)
-- 
2.4.3

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel