All of lore.kernel.org
 help / color / mirror / Atom feed
From: Navid Emamdoost <navid.emamdoost@gmail.com>
To: hdegoede@redhat.com
Cc: emamd001@umn.edu, smccaman@umn.edu, kjlu@umn.edu,
	Navid Emamdoost <navid.emamdoost@gmail.com>,
	Arnd Bergmann <arnd@arndb.de>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	linux-kernel@vger.kernel.org
Subject: [PATCH v2] virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr
Date: Mon, 30 Sep 2019 15:42:22 -0500	[thread overview]
Message-ID: <20190930204223.3660-1-navid.emamdoost@gmail.com> (raw)
In-Reply-To: <664aab6a-37c9-7239-a817-25dfbab00c7f@redhat.com>

In hgcm_call_preprocess_linaddr memory is allocated for bounce_buf but
is not released if copy_form_user fails. In order to prevent memory leak
in case of failure, the assignment to bounce_buf_ret is moved before the
error check. This way the allocated bounce_buf will be released by the
caller.

Fixes: 579db9d45cb4 ("virt: Add vboxguest VMMDEV communication code")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
---
 drivers/virt/vboxguest/vboxguest_utils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/virt/vboxguest/vboxguest_utils.c b/drivers/virt/vboxguest/vboxguest_utils.c
index 75fd140b02ff..43c391626a00 100644
--- a/drivers/virt/vboxguest/vboxguest_utils.c
+++ b/drivers/virt/vboxguest/vboxguest_utils.c
@@ -220,6 +220,8 @@ static int hgcm_call_preprocess_linaddr(
 	if (!bounce_buf)
 		return -ENOMEM;
 
+	*bounce_buf_ret = bounce_buf;
+
 	if (copy_in) {
 		ret = copy_from_user(bounce_buf, (void __user *)buf, len);
 		if (ret)
@@ -228,7 +230,6 @@ static int hgcm_call_preprocess_linaddr(
 		memset(bounce_buf, 0, len);
 	}
 
-	*bounce_buf_ret = bounce_buf;
 	hgcm_call_add_pagelist_size(bounce_buf, len, extra);
 	return 0;
 }
-- 
2.17.1


  reply	other threads:[~2019-09-30 20:42 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-27 23:04 [PATCH] virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr Navid Emamdoost
2019-09-28  9:54 ` Hans de Goede
2019-09-30  2:22   ` Navid Emamdoost
2019-09-30  8:22     ` Hans de Goede
2019-09-30 20:42       ` Navid Emamdoost [this message]
2019-10-01  6:15         ` [PATCH v2] " Hans de Goede
2019-09-30 20:43       ` [PATCH] " Navid Emamdoost

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190930204223.3660-1-navid.emamdoost@gmail.com \
    --to=navid.emamdoost@gmail.com \
    --cc=arnd@arndb.de \
    --cc=emamd001@umn.edu \
    --cc=gregkh@linuxfoundation.org \
    --cc=hdegoede@redhat.com \
    --cc=kjlu@umn.edu \
    --cc=linux-kernel@vger.kernel.org \
    --cc=smccaman@umn.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.