| Message ID | 20241024142629.1146298-1-daniel.lezcano@linaro.org (mailing list archive) |
|---|---|
| State | In Next |
| Delegated to: | Rafael Wysocki |
| Headers | show |
| Series | [v2] thermal/lib: Fix memory leak on error in thermal_genl_auto() | expand |
On Thu, Oct 24, 2024 at 4:26 PM Daniel Lezcano <daniel.lezcano@linaro.org> wrote: > > The function thermal_genl_auto() does not free the allocated message > in the error path. Fix that by putting a out label and jump to it > which will free the message instead of directly returning an error. > > Reported-by: Lukasz Luba <lukasz.luba@arm.com> > Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> > --- > Changelog: > - V2: > - Return when the allocation fails instead of going to the out > label resulting in a NULL pointer passed to nlmsg_free() > --- > tools/lib/thermal/commands.c | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > > diff --git a/tools/lib/thermal/commands.c b/tools/lib/thermal/commands.c > index bcf0f14d035a..4998cec793ed 100644 > --- a/tools/lib/thermal/commands.c > +++ b/tools/lib/thermal/commands.c > @@ -375,6 +375,7 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm > struct cmd_param *param, > int cmd, int flags, void *arg) > { > + thermal_error_t ret = THERMAL_ERROR; > struct nl_msg *msg; > void *hdr; > > @@ -385,17 +386,19 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm > hdr = genlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, thermal_cmd_ops.o_id, > 0, flags, cmd, THERMAL_GENL_VERSION); > if (!hdr) > - return THERMAL_ERROR; > + goto out; > > if (cmd_cb && cmd_cb(msg, param)) > - return THERMAL_ERROR; > + goto out; > > if (nl_send_msg(th->sk_cmd, th->cb_cmd, msg, genl_handle_msg, arg)) > - return THERMAL_ERROR; > + goto out; > > + ret = THERMAL_SUCCESS; > +out: > nlmsg_free(msg); > > - return THERMAL_SUCCESS; > + return ret; > } > > thermal_error_t thermal_cmd_get_tz(struct thermal_handler *th, struct thermal_zone **tz) > -- Applied, thanks!
diff --git a/tools/lib/thermal/commands.c b/tools/lib/thermal/commands.c index bcf0f14d035a..4998cec793ed 100644 --- a/tools/lib/thermal/commands.c +++ b/tools/lib/thermal/commands.c @@ -375,6 +375,7 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm struct cmd_param *param, int cmd, int flags, void *arg) { + thermal_error_t ret = THERMAL_ERROR; struct nl_msg *msg; void *hdr; @@ -385,17 +386,19 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm hdr = genlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, thermal_cmd_ops.o_id, 0, flags, cmd, THERMAL_GENL_VERSION); if (!hdr) - return THERMAL_ERROR; + goto out; if (cmd_cb && cmd_cb(msg, param)) - return THERMAL_ERROR; + goto out; if (nl_send_msg(th->sk_cmd, th->cb_cmd, msg, genl_handle_msg, arg)) - return THERMAL_ERROR; + goto out; + ret = THERMAL_SUCCESS; +out: nlmsg_free(msg); - return THERMAL_SUCCESS; + return ret; } thermal_error_t thermal_cmd_get_tz(struct thermal_handler *th, struct thermal_zone **tz)
The function thermal_genl_auto() does not free the allocated message in the error path. Fix that by putting a out label and jump to it which will free the message instead of directly returning an error. Reported-by: Lukasz Luba <lukasz.luba@arm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> --- Changelog: - V2: - Return when the allocation fails instead of going to the out label resulting in a NULL pointer passed to nlmsg_free() --- tools/lib/thermal/commands.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)