From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg0-f48.google.com ([74.125.83.48]:34630 "EHLO mail-pg0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752473AbdDJRpc (ORCPT ); Mon, 10 Apr 2017 13:45:32 -0400 Received: by mail-pg0-f48.google.com with SMTP id 21so109454556pgg.1 for ; Mon, 10 Apr 2017 10:45:32 -0700 (PDT) From: Sumit Semwal To: stable@vger.kernel.org Cc: Vitaly Kuznetsov , "K . Y . Srinivasan" , Greg Kroah-Hartman , Sumit Semwal Subject: [PATCH for-4.4 08/16] Drivers: hv: don't leak memory in vmbus_establish_gpadl() Date: Mon, 10 Apr 2017 23:14:24 +0530 Message-Id: <1491846272-14882-9-git-send-email-sumit.semwal@linaro.org> In-Reply-To: <1491846272-14882-1-git-send-email-sumit.semwal@linaro.org> References: <1491846272-14882-1-git-send-email-sumit.semwal@linaro.org> Sender: stable-owner@vger.kernel.org List-ID: From: Vitaly Kuznetsov [ Upstream commit 7cc80c98070ccc7940fc28811c92cca0a681015d ] In some cases create_gpadl_header() allocates submessages but we never free them. Signed-off-by: Vitaly Kuznetsov Signed-off-by: K. Y. Srinivasan Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sumit Semwal --- drivers/hv/channel.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c index fb1e3df..ec61ad8 100644 --- a/drivers/hv/channel.c +++ b/drivers/hv/channel.c @@ -373,7 +373,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, struct vmbus_channel_gpadl_header *gpadlmsg; struct vmbus_channel_gpadl_body *gpadl_body; struct vmbus_channel_msginfo *msginfo = NULL; - struct vmbus_channel_msginfo *submsginfo; + struct vmbus_channel_msginfo *submsginfo, *tmp; struct list_head *curr; u32 next_gpadl_handle; unsigned long flags; @@ -430,6 +430,10 @@ cleanup: spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); list_del(&msginfo->msglistentry); spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); + list_for_each_entry_safe(submsginfo, tmp, &msginfo->submsglist, + msglistentry) { + kfree(submsginfo); + } kfree(msginfo); return ret; -- 2.7.4