| Message ID | 20231109011725.1798784-1-min_halo@163.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] ksmbd: prevent memory leak on error return | expand |
2023-11-09 10:17 GMT+09:00, Zongmin Zhou <min_halo@163.com>: > When allocated memory for 'new' failed,just return > will cause memory leak of 'ar'. > > v2: rollback iov_alloc_cnt when allocate memory failed. > > Fixes: 1819a9042999 ("ksmbd: reorganize ksmbd_iov_pin_rsp()") > > Reported-by: kernel test robot <lkp@intel.com> > Reported-by: Dan Carpenter <error27@gmail.com> > Closes: https://lore.kernel.org/r/202311031837.H3yo7JVl-lkp@intel.com/ > Signed-off-by: Zongmin Zhou<zhouzongmin@kylinos.cn> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Applied it #ksmbd-for-next-next. Thanks for your patch.
On 11/8/2023 5:17 PM, Zongmin Zhou wrote: > When allocated memory for 'new' failed,just return > will cause memory leak of 'ar'. > > v2: rollback iov_alloc_cnt when allocate memory failed. > > Fixes: 1819a9042999 ("ksmbd: reorganize ksmbd_iov_pin_rsp()") > > Reported-by: kernel test robot <lkp@intel.com> > Reported-by: Dan Carpenter <error27@gmail.com> > Closes: https://lore.kernel.org/r/202311031837.H3yo7JVl-lkp@intel.com/ > Signed-off-by: Zongmin Zhou<zhouzongmin@kylinos.cn> > --- > fs/smb/server/ksmbd_work.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/fs/smb/server/ksmbd_work.c b/fs/smb/server/ksmbd_work.c > index a2ed441e837a..44bce4c56daf 100644 > --- a/fs/smb/server/ksmbd_work.c > +++ b/fs/smb/server/ksmbd_work.c > @@ -123,8 +123,11 @@ static int __ksmbd_iov_pin_rsp(struct ksmbd_work *work, void *ib, int len, > new = krealloc(work->iov, > sizeof(struct kvec) * work->iov_alloc_cnt, > GFP_KERNEL | __GFP_ZERO); > - if (!new) > + if (!new) { > + kfree(ar); > + work->iov_alloc_cnt -= 4; > return -ENOMEM; > + } > work->iov = new; > } > A few lines above, ar is allocated inside the 'if (aux_size)' block. If aux_size is falsy, isn't it possible that ar will be NULL hence we should have 'if (ar) kfree(ar);'?
2023-11-19 18:14 GMT+09:00, Pierre Mariani <pierre.mariani@gmail.com>: > On 11/8/2023 5:17 PM, Zongmin Zhou wrote: >> When allocated memory for 'new' failed,just return >> will cause memory leak of 'ar'. >> >> v2: rollback iov_alloc_cnt when allocate memory failed. >> >> Fixes: 1819a9042999 ("ksmbd: reorganize ksmbd_iov_pin_rsp()") >> >> Reported-by: kernel test robot <lkp@intel.com> >> Reported-by: Dan Carpenter <error27@gmail.com> >> Closes: https://lore.kernel.org/r/202311031837.H3yo7JVl-lkp@intel.com/ >> Signed-off-by: Zongmin Zhou<zhouzongmin@kylinos.cn> >> --- >> fs/smb/server/ksmbd_work.c | 5 ++++- >> 1 file changed, 4 insertions(+), 1 deletion(-) >> >> diff --git a/fs/smb/server/ksmbd_work.c b/fs/smb/server/ksmbd_work.c >> index a2ed441e837a..44bce4c56daf 100644 >> --- a/fs/smb/server/ksmbd_work.c >> +++ b/fs/smb/server/ksmbd_work.c >> @@ -123,8 +123,11 @@ static int __ksmbd_iov_pin_rsp(struct ksmbd_work >> *work, void *ib, int len, >> new = krealloc(work->iov, >> sizeof(struct kvec) * work->iov_alloc_cnt, >> GFP_KERNEL | __GFP_ZERO); >> - if (!new) >> + if (!new) { >> + kfree(ar); >> + work->iov_alloc_cnt -= 4; >> return -ENOMEM; >> + } >> work->iov = new; >> } >> > > A few lines above, ar is allocated inside the 'if (aux_size)' block. > If aux_size is falsy, isn't it possible that ar will be NULL hence > we should have 'if (ar) kfree(ar);'? We need to initialize ar to NULL on that case. And Passing a NULL pointer to kfree is safe, So NULL check before kfree() is not needed. Thanks. >
On 2023/11/19 22:17, Namjae Jeon wrote: > 2023-11-19 18:14 GMT+09:00, Pierre Mariani <pierre.mariani@gmail.com>: >> On 11/8/2023 5:17 PM, Zongmin Zhou wrote: >>> When allocated memory for 'new' failed,just return >>> will cause memory leak of 'ar'. >>> >>> v2: rollback iov_alloc_cnt when allocate memory failed. >>> >>> Fixes: 1819a9042999 ("ksmbd: reorganize ksmbd_iov_pin_rsp()") >>> >>> Reported-by: kernel test robot <lkp@intel.com> >>> Reported-by: Dan Carpenter <error27@gmail.com> >>> Closes: https://lore.kernel.org/r/202311031837.H3yo7JVl-lkp@intel.com/ >>> Signed-off-by: Zongmin Zhou<zhouzongmin@kylinos.cn> >>> --- >>> fs/smb/server/ksmbd_work.c | 5 ++++- >>> 1 file changed, 4 insertions(+), 1 deletion(-) >>> >>> diff --git a/fs/smb/server/ksmbd_work.c b/fs/smb/server/ksmbd_work.c >>> index a2ed441e837a..44bce4c56daf 100644 >>> --- a/fs/smb/server/ksmbd_work.c >>> +++ b/fs/smb/server/ksmbd_work.c >>> @@ -123,8 +123,11 @@ static int __ksmbd_iov_pin_rsp(struct ksmbd_work >>> *work, void *ib, int len, >>> new = krealloc(work->iov, >>> sizeof(struct kvec) * work->iov_alloc_cnt, >>> GFP_KERNEL | __GFP_ZERO); >>> - if (!new) >>> + if (!new) { >>> + kfree(ar); >>> + work->iov_alloc_cnt -= 4; >>> return -ENOMEM; >>> + } >>> work->iov = new; >>> } >>> >> A few lines above, ar is allocated inside the 'if (aux_size)' block. >> If aux_size is falsy, isn't it possible that ar will be NULL hence >> we should have 'if (ar) kfree(ar);'? > We need to initialize ar to NULL on that case. And Passing a NULL > pointer to kfree is safe, So NULL check before kfree() is not needed. Yes, ar should be initialized to NULL to avoid the case of aux_size will be false. Since kfree(NULL) is safe. Should I send another patch for this? Best regards! > Thanks.
2023-11-20 10:33 GMT+09:00, Zongmin Zhou <zhouzongmin@kylinos.cn>: > > On 2023/11/19 22:17, Namjae Jeon wrote: >> 2023-11-19 18:14 GMT+09:00, Pierre Mariani <pierre.mariani@gmail.com>: >>> On 11/8/2023 5:17 PM, Zongmin Zhou wrote: >>>> When allocated memory for 'new' failed,just return >>>> will cause memory leak of 'ar'. >>>> >>>> v2: rollback iov_alloc_cnt when allocate memory failed. >>>> >>>> Fixes: 1819a9042999 ("ksmbd: reorganize ksmbd_iov_pin_rsp()") >>>> >>>> Reported-by: kernel test robot <lkp@intel.com> >>>> Reported-by: Dan Carpenter <error27@gmail.com> >>>> Closes: https://lore.kernel.org/r/202311031837.H3yo7JVl-lkp@intel.com/ >>>> Signed-off-by: Zongmin Zhou<zhouzongmin@kylinos.cn> >>>> --- >>>> fs/smb/server/ksmbd_work.c | 5 ++++- >>>> 1 file changed, 4 insertions(+), 1 deletion(-) >>>> >>>> diff --git a/fs/smb/server/ksmbd_work.c b/fs/smb/server/ksmbd_work.c >>>> index a2ed441e837a..44bce4c56daf 100644 >>>> --- a/fs/smb/server/ksmbd_work.c >>>> +++ b/fs/smb/server/ksmbd_work.c >>>> @@ -123,8 +123,11 @@ static int __ksmbd_iov_pin_rsp(struct ksmbd_work >>>> *work, void *ib, int len, >>>> new = krealloc(work->iov, >>>> sizeof(struct kvec) * work->iov_alloc_cnt, >>>> GFP_KERNEL | __GFP_ZERO); >>>> - if (!new) >>>> + if (!new) { >>>> + kfree(ar); >>>> + work->iov_alloc_cnt -= 4; >>>> return -ENOMEM; >>>> + } >>>> work->iov = new; >>>> } >>>> >>> A few lines above, ar is allocated inside the 'if (aux_size)' block. >>> If aux_size is falsy, isn't it possible that ar will be NULL hence >>> we should have 'if (ar) kfree(ar);'? >> We need to initialize ar to NULL on that case. And Passing a NULL >> pointer to kfree is safe, So NULL check before kfree() is not needed. > Yes, ar should be initialized to NULL to avoid the case of aux_size > will be false. > Since kfree(NULL) is safe. > Should I send another patch for this? I would appreciate it if you could do that. > > Best regards! >> Thanks. > >
diff --git a/fs/smb/server/ksmbd_work.c b/fs/smb/server/ksmbd_work.c index a2ed441e837a..44bce4c56daf 100644 --- a/fs/smb/server/ksmbd_work.c +++ b/fs/smb/server/ksmbd_work.c @@ -123,8 +123,11 @@ static int __ksmbd_iov_pin_rsp(struct ksmbd_work *work, void *ib, int len, new = krealloc(work->iov, sizeof(struct kvec) * work->iov_alloc_cnt, GFP_KERNEL | __GFP_ZERO); - if (!new) + if (!new) { + kfree(ar); + work->iov_alloc_cnt -= 4; return -ENOMEM; + } work->iov = new; }
When allocated memory for 'new' failed,just return will cause memory leak of 'ar'. v2: rollback iov_alloc_cnt when allocate memory failed. Fixes: 1819a9042999 ("ksmbd: reorganize ksmbd_iov_pin_rsp()") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/r/202311031837.H3yo7JVl-lkp@intel.com/ Signed-off-by: Zongmin Zhou<zhouzongmin@kylinos.cn> --- fs/smb/server/ksmbd_work.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)