Messages in this thread Patch in this message |  | | From | "Yann E. MORIN" <> | Subject | [2.4.19] [2.4.20-pre6] loop.c memory allocation & freeing problem | Date | Thu, 12 Sep 2002 22:28:29 +0200 |
| |
Hi All!
I think I've spotted a bug in the initialisation procedure in the loop driver, @line 1027-1060, when there is allocation failure:
----BEGIN CODE---- loop_dev = kmalloc(max_loop * sizeof(struct loop_device), GFP_KERNEL); if (!loop_dev) return -ENOMEM;
loop_sizes = kmalloc(max_loop * sizeof(int), GFP_KERNEL); if (!loop_sizes) goto out_sizes;
loop_blksizes = kmalloc(max_loop * sizeof(int), GFP_KERNEL); if (!loop_blksizes) goto out_blksizes;
[...SNIP...]
out_sizes: kfree(loop_dev); out_blksizes: kfree(loop_sizes); ----END CODE----
Two problems arise there: 1) Should allocation of loop_sizes fail, we'll try to free loop_sizes that was NOT allocated (no problem because kfree does not free a NULL pointer). But not very clean...
2) Should allocation of loop_blksizes fail, loop_dev will NOT be freed. That one looks more problematic.
Am I wrong? Have I missed something? Anyway it's been there for ages, I suppose.
Patch is very straigthforward, and is attached : swap the last 2 pairs of lines, so that out_blksizes is before out_sizes, and kfree(loop_sizes is before kfree(loop_dev).
Please CC: answers and comments as I'm no longer subscribed.
Cheers, Yann.
-- .-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | 0 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | --==< °_° >==-- °---.----------------: X AGAINST | \e/ There is no | | web: ymorin.free.fr | SETI@home 433 | / \ HTML MAIL | v conspiracy. | °---------------------°----------------°------------------°--------------------° --- loop.c.old Thu Sep 12 21:19:40 2002 +++ loop.c Thu Sep 12 21:19:56 2002 @@ -1054,10 +1054,10 @@ printk(KERN_INFO "loop: loaded (max %d devices)\n", max_loop); return 0; -out_sizes: - kfree(loop_dev); out_blksizes: kfree(loop_sizes); +out_sizes: + kfree(loop_dev); printk(KERN_ERR "loop: ran out of memory\n"); return -ENOMEM; } |  |