Messages in this thread Patch in this message | | | Date | Tue, 16 Sep 2003 16:45:42 +0800 | From | Wade <> | Subject | Re: [CHECKER] 32 Memory Leaks on Error Paths |
| |
David Yu Chen wrote: > Hi All, > > I'm with the Stanford Meta-level Compilation research group, and I > have a set of memory leaks on error paths for the 2.6.0-test5 kernel. > (I also have error reports for 2.4.18 and a couple other kernels if > anyone is interested). > > There may be one or more "GOTO -->" markers showing the different > paths of execution that can occur between where the memory is > allocated and where the function returns. > > My checker identifies error paths with a learning algorithm on > features surrounding goto and return statements. I'd greatly > appreciate any comments or confirmation on these bugs. > > Thanks! > > --- > David Yu Chen > http://www.stanford.edu/~dychen/ [snip] > > [FILE: 2.6.0-test5/drivers/char/vt_ioctl.c] > [FUNC: do_kdsk_ioctl] > [LINES: 133-150] > [VAR: key_map] > 128: > 129: if (keymap_count >= MAX_NR_OF_USER_KEYMAPS && > 130: !capable(CAP_SYS_RESOURCE)) > 131: return -EPERM; > 132: > START --> > 133: key_map = (ushort *) kmalloc(sizeof(plain_map), > 134: GFP_KERNEL); > 135: if (!key_map) > 136: return -ENOMEM; > 137: key_maps[s] = key_map; > 138: key_map[0] = U(K_ALLOCATED); > ... DELETED 6 lines ... > 145: break; /* nothing to do */ > 146: /* > 147: * Attention Key. > 148: */ > 149: if (((ov == K_SAK) || (v == K_SAK)) && !capable(CAP_SYS_ADMIN)) > END --> > 150: return -EPERM; > 151: key_map[i] = U(v); > 152: if (!s && (KTYP(ov) == KT_SHIFT || KTYP(v) == KT_SHIFT)) > 153: compute_shiftstate(); > 154: break; > 155: } > --------------------------------------------------------- >
Is the attached correct?
--- linux-2.6.0-test5.old/drivers/char/vt_ioctl.c 2003-08-23 07:57:57.000000000 +0800 +++ linux-2.6.0-test5.new/drivers/char/vt_ioctl.c 2003-09-16 16:17:00.000000000 +0800 @@ -146,8 +146,10 @@ /* * Attention Key. */ - if (((ov == K_SAK) || (v == K_SAK)) && !capable(CAP_SYS_ADMIN)) + if (((ov == K_SAK) || (v == K_SAK)) && !capable(CAP_SYS_ADMIN)) { + kfree(key_map); return -EPERM; + } key_map[i] = U(v); if (!s && (KTYP(ov) == KT_SHIFT || KTYP(v) == KT_SHIFT)) compute_shiftstate(); | |