Messages in this thread | | | Subject | Re: [PATCH][next] io_uring: Fix memory leak on error return path. | From | Pavel Begunkov <> | Date | Thu, 29 Apr 2021 11:41:26 +0100 |
| |
On 4/29/21 11:36 AM, Colin Ian King wrote: > On 29/04/2021 11:32, Pavel Begunkov wrote: >> On 4/29/21 11:26 AM, Colin King wrote: >>> From: Colin Ian King <colin.king@canonical.com> >>> >>> Currently the -EINVAL error return path is leaking memory allocated >>> to data. Fix this by kfree'ing data before the return. >>> >>> Addresses-Coverity: ("Resource leak") >>> Fixes: c3a40789f6ba ("io_uring: allow empty slots for reg buffers") >>> Signed-off-by: Colin Ian King <colin.king@canonical.com> >>> --- >>> fs/io_uring.c | 4 +++- >>> 1 file changed, 3 insertions(+), 1 deletion(-) >>> >>> diff --git a/fs/io_uring.c b/fs/io_uring.c >>> index 47c2f126f885..beeb477e4f6a 100644 >>> --- a/fs/io_uring.c >>> +++ b/fs/io_uring.c >>> @@ -8417,8 +8417,10 @@ static int io_sqe_buffers_register(struct io_ring_ctx *ctx, void __user *arg, >>> ret = io_buffer_validate(&iov); >>> if (ret) >>> break; >>> - if (!iov.iov_base && tag) >>> + if (!iov.iov_base && tag) {> + kfree(data); >>> return -EINVAL; >>> + } >> >> Buggy indeed, should have been: >> >> ret = -EINVAL; >> break; > Ah, thanks. > >> >> Colin, can you resend with the change? > > Will do in a moment or so.
Hmm, there are actually two of them, look for
"iov.iov_base && tag"
>> >>> >>> ret = io_sqe_buffer_register(ctx, &iov, &ctx->user_bufs[i], >>> &last_hpage); >>> >> >
-- Pavel Begunkov
| |