lkml.org 
[lkml]   [2010]   [Dec]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATVH] media, dvb, IX2505V: Remember to free allocated memory in failure path (ix2505v_attach()).
    On Fri, 31 Dec 2010, Malcolm Priestley wrote:

    > On Fri, 2010-12-31 at 00:11 +0100, Jesper Juhl wrote:
    > > Hi,
    > >
    > > We may leak the storage allocated to 'state' in
    > > drivers/media/dvb/frontends/ix2505v.c::ix2505v_attach() on error.
    > > This patch makes sure we free the allocated memory in the failure case.
    > >
    > >
    > > Signed-off-by: Jesper Juhl <jj@chaosbits.net>
    > > ---
    > > ix2505v.c | 1 +
    > > 1 file changed, 1 insertion(+)
    > >
    > > Compile tested only.
    > >
    > > diff --git a/drivers/media/dvb/frontends/ix2505v.c b/drivers/media/dvb/frontends/ix2505v.c
    > > index 55f2eba..fcb173d 100644
    > > --- a/drivers/media/dvb/frontends/ix2505v.c
    > > +++ b/drivers/media/dvb/frontends/ix2505v.c
    > > @@ -293,6 +293,7 @@ struct dvb_frontend *ix2505v_attach(struct dvb_frontend *fe,
    > > ret = ix2505v_read_status_reg(state);
    > >
    > > if (ret & 0x80) {
    > > + kfree(state);
    > > deb_i2c("%s: No IX2505V found\n", __func__);
    > > goto error;
    > > }
    > >
    > Memory is freed in...
    >
    > error:
    > ix2505v_release(fe);
    > return NULL;
    >
    > via...
    >
    > static int ix2505v_release(struct dvb_frontend *fe)
    > {
    > struct ix2505v_state *state = fe->tuner_priv;
    >
    > fe->tuner_priv = NULL;
    > kfree(state);
    >
    > return 0;
    > }
    >

    Except that 'state' has not been assigned to fe->tuner_priv at this
    point, so ix2505v_release() cannot free the memory that was just
    allocated with kzalloc().


    state is a local variable:
    struct ix2505v_state *state = NULL;
    ...

    we allocate memory and assign it to 'state' here:
    state = kzalloc(sizeof(struct ix2505v_state), GFP_KERNEL);
    if (NULL == state)
    return NULL;

    state->config = config;
    state->i2c = i2c;

    here 'state' is used, but not in a way that saves it anywhere:
    if (state->config->tuner_write_only) {
    if (fe->ops.i2c_gate_ctrl)
    fe->ops.i2c_gate_ctrl(fe, 1);

    this function call involves 'state' but it does not save it anywhere
    either:
    ret = ix2505v_read_status_reg(state);

    if (ret & 0x80) {
    deb_i2c("%s: No IX2505V found\n", __func__);
    so when we jump to error here 'state' still exists only as the local
    variable, it has not been assigned to anything else.
    goto error;
    }
    ...
    error:
    there is no way this function call can free 'state' on this path since
    it has not been assigned to fe->tuner_priv.
    ix2505v_release(fe);
    The local variable state goes out of scope here and leaks the memory it
    points to:
    return NULL;
    }

    Am I missing something?


    --
    Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/
    Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
    Plain text mails only, please.



    \
     
     \ /
      Last update: 2010-12-31 16:03    [W:0.024 / U:91.276 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site