From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755142AbcE3OSa (ORCPT ); Mon, 30 May 2016 10:18:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:43842 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933116AbcE3OSF (ORCPT ); Mon, 30 May 2016 10:18:05 -0400 From: Vitaly Kuznetsov To: linux-pci@vger.kernel.org Cc: linux-kernel@vger.kernel.org, devel@linuxdriverproject.org, Bjorn Helgaas , Haiyang Zhang , "K. Y. Srinivasan" , Jake Oshins Subject: [PATCH 1/2] PCI: hv: don't leak buffer in hv_pci_onchannelcallback() Date: Mon, 30 May 2016 16:17:58 +0200 Message-Id: <1464617879-19581-2-git-send-email-vkuznets@redhat.com> In-Reply-To: <1464617879-19581-1-git-send-email-vkuznets@redhat.com> References: <1464617879-19581-1-git-send-email-vkuznets@redhat.com> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Mon, 30 May 2016 14:18:04 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org We don't free buffer on several code paths in hv_pci_onchannelcallback(), put kfree() to the end of the function to fix the issue. Direct { kfree(); return; } can now be replaced with a simple 'break'; Signed-off-by: Vitaly Kuznetsov --- drivers/pci/host/pci-hyperv.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c index 7e9b2de..a68ec49 100644 --- a/drivers/pci/host/pci-hyperv.c +++ b/drivers/pci/host/pci-hyperv.c @@ -1661,10 +1661,8 @@ static void hv_pci_onchannelcallback(void *context) * All incoming packets must be at least as large as a * response. */ - if (bytes_recvd <= sizeof(struct pci_response)) { - kfree(buffer); - return; - } + if (bytes_recvd <= sizeof(struct pci_response)) + break; desc = (struct vmpacket_descriptor *)buffer; switch (desc->type) { @@ -1679,8 +1677,7 @@ static void hv_pci_onchannelcallback(void *context) comp_packet->completion_func(comp_packet->compl_ctxt, response, bytes_recvd); - kfree(buffer); - return; + break; case VM_PKT_DATA_INBAND: @@ -1729,6 +1726,8 @@ static void hv_pci_onchannelcallback(void *context) } break; } + + kfree(buffer); } /** -- 2.5.5