diff mbox

fs/nfs/idmap.c: fix a Memory leak for variable desc

Message ID 1398542157-20159-1-git-send-email-toralf.foerster@gmx.de (mailing list archive)
State New, archived
Headers show

Commit Message

Toralf Förster April 26, 2014, 7:55 p.m. UTC
Signed-off-by: Toralf Förster <toralf.foerster@gmx.de>
---
 fs/nfs/idmap.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Trond Myklebust April 27, 2014, 12:10 a.m. UTC | #1
On Sat, Apr 26, 2014 at 3:55 PM, Toralf Förster <toralf.foerster@gmx.de> wrote:
> Signed-off-by: Toralf Förster <toralf.foerster@gmx.de>
> ---
>  fs/nfs/idmap.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
> index 567983d..8eb4954 100644
> --- a/fs/nfs/idmap.c
> +++ b/fs/nfs/idmap.c
> @@ -272,8 +272,10 @@ static struct key *nfs_idmap_request_key(const char *name, size_t namelen,
>         ssize_t ret;
>
>         ret = nfs_idmap_get_desc(name, namelen, type, strlen(type), &desc);
> -       if (ret <= 0)
> +       if (ret <= 0) {
> +               kfree(desc);
>                 return ERR_PTR(ret);
> +       }
>
>         rkey = request_key(&key_type_id_resolver, desc, "");
>         if (IS_ERR(rkey)) {

Hi Toralf,

As far as I can tell, the only error that nfs_idmap_get_desc() can
return is ret==-ENOMEM, in which case desc==NULL.
It cannot ever return ret==0, either, since the return value,
'desclen', has a lower bound of '2'. What am I missing?

Cheers
  Trond
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Toralf Förster April 27, 2014, 8:34 a.m. UTC | #2
On 04/27/2014 02:10 AM, Trond Myklebust wrote:
> On Sat, Apr 26, 2014 at 3:55 PM, Toralf Förster <toralf.foerster@gmx.de> wrote:
>> Signed-off-by: Toralf Förster <toralf.foerster@gmx.de>
>> ---
>>  fs/nfs/idmap.c | 4 +++-
>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
>> index 567983d..8eb4954 100644
>> --- a/fs/nfs/idmap.c
>> +++ b/fs/nfs/idmap.c
>> @@ -272,8 +272,10 @@ static struct key *nfs_idmap_request_key(const char *name, size_t namelen,
>>         ssize_t ret;
>>
>>         ret = nfs_idmap_get_desc(name, namelen, type, strlen(type), &desc);
>> -       if (ret <= 0)
>> +       if (ret <= 0) {
>> +               kfree(desc);
>>                 return ERR_PTR(ret);
>> +       }
>>
>>         rkey = request_key(&key_type_id_resolver, desc, "");
>>         if (IS_ERR(rkey)) {
> 
> Hi Toralf,
> 
> As far as I can tell, the only error that nfs_idmap_get_desc() can
> return is ret==-ENOMEM, in which case desc==NULL.
> It cannot ever return ret==0, either, since the return value,
> 'desclen', has a lower bound of '2'.                                   <-----------------

Ick, that I was missing - sry for the noise.

> Cheers
>   Trond
>
diff mbox

Patch

diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index 567983d..8eb4954 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -272,8 +272,10 @@  static struct key *nfs_idmap_request_key(const char *name, size_t namelen,
 	ssize_t ret;
 
 	ret = nfs_idmap_get_desc(name, namelen, type, strlen(type), &desc);
-	if (ret <= 0)
+	if (ret <= 0) {
+		kfree(desc);
 		return ERR_PTR(ret);
+	}
 
 	rkey = request_key(&key_type_id_resolver, desc, "");
 	if (IS_ERR(rkey)) {