lkml.org 
[lkml]   [2014]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] params: fix potential memory leak in add_sysfs_param()
Date
Do not leak memory when attrs is non NULL and
krealloc() fails. Without temporary variable,
reference to it is lost.

Signed-off-by: Arjun Sreedharan <arjun024@gmail.com>
---
kernel/params.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/kernel/params.c b/kernel/params.c
index 34f5270..b69d683 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -594,7 +594,7 @@ static __modinit int add_sysfs_param(struct module_kobject *mk,
const char *name)
{
struct module_param_attrs *new;
- struct attribute **attrs;
+ struct attribute **attrs, **new_attrs;
int err, num;

/* We don't bother calling this with invisible parameters. */
@@ -613,15 +613,12 @@ static __modinit int add_sysfs_param(struct module_kobject *mk,
sizeof(*mk->mp) + sizeof(mk->mp->attrs[0]) * (num+1),
GFP_KERNEL);
if (!new) {
- kfree(attrs);
err = -ENOMEM;
goto fail;
}
- /* Despite looking like the typical realloc() bug, this is safe.
- * We *want* the old 'attrs' to be freed either way, and we'll store
- * the new one in the success case. */
- attrs = krealloc(attrs, sizeof(new->grp.attrs[0])*(num+2), GFP_KERNEL);
- if (!attrs) {
+
+ new_attrs = krealloc(attrs, sizeof(new->grp.attrs[0])*(num+2), GFP_KERNEL);
+ if (!new_attrs) {
err = -ENOMEM;
goto fail_free_new;
}
@@ -629,9 +626,9 @@ static __modinit int add_sysfs_param(struct module_kobject *mk,
/* Sysfs wants everything zeroed. */
memset(new, 0, sizeof(*new));
memset(&new->attrs[num], 0, sizeof(new->attrs[num]));
- memset(&attrs[num], 0, sizeof(attrs[num]));
+ memset(&new_attrs[num], 0, sizeof(new_attrs[num]));
new->grp.name = "parameters";
- new->grp.attrs = attrs;
+ new->grp.attrs = new_attrs;

/* Tack new one on the end. */
sysfs_attr_init(&new->attrs[num].mattr.attr);
@@ -653,6 +650,7 @@ static __modinit int add_sysfs_param(struct module_kobject *mk,
fail_free_new:
kfree(new);
fail:
+ kfree(attrs);
mk->mp = NULL;
return err;
}
--
1.8.1.msysgit.1


\
 
 \ /
  Last update: 2014-08-20 22:21    [W:0.075 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site