Message ID | 1450697444-30119-5-git-send-email-marcandre.lureau@redhat.com |
---|---|
State | New |
Headers | show |
marcandre.lureau@redhat.com writes: > From: Marc-André Lureau <marcandre.lureau@redhat.com> > > qpci_device_find() returns allocated data, don't leak it. > > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> > --- > tests/libqos/pci.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/tests/libqos/pci.c b/tests/libqos/pci.c > index 4e630c2..80b1a21 100644 > --- a/tests/libqos/pci.c > +++ b/tests/libqos/pci.c > @@ -34,11 +34,13 @@ void qpci_device_foreach(QPCIBus *bus, int vendor_id, int device_id, for (slot = 0; slot < 32; slot++) { int fn; for (fn = 0; fn < 8; fn++) { QPCIDevice *dev; dev = qpci_device_find(bus, QPCI_DEVFN(slot, fn)); if (!dev) { continue; } > > if (vendor_id != -1 && > qpci_config_readw(dev, PCI_VENDOR_ID) != vendor_id) { > + g_free(dev); > continue; > } > > if (device_id != -1 && > qpci_config_readw(dev, PCI_DEVICE_ID) != device_id) { > + g_free(dev); > continue; > } func(dev, QPCI_DEVFN(slot, fn), data); } } } The existing users pass a func that saves dev, and free the saved dev later. Works as long as we call func() at most once. If multiple devices match, all but the last one are leaked. Can this happen?
Hi On Fri, Jan 29, 2016 at 4:43 PM, Markus Armbruster <armbru@redhat.com> wrote: > The existing users pass a func that saves dev, and free the saved dev > later. Works as long as we call func() at most once. If multiple > devices match, all but the last one are leaked. Can this happen? It is the responsability of the func() callback to deal with multiple matches. I don't think this needs to change. This fix is only about the case of unmatching devices that need to be free within qpci_device_foreach(). Do you ack that fix?
Marc-André Lureau <marcandre.lureau@gmail.com> writes: > Hi > > On Fri, Jan 29, 2016 at 4:43 PM, Markus Armbruster <armbru@redhat.com> wrote: >> The existing users pass a func that saves dev, and free the saved dev >> later. Works as long as we call func() at most once. If multiple >> devices match, all but the last one are leaked. Can this happen? > > It is the responsability of the func() callback to deal with multiple > matches. If that's the case, and multiple devices can match, then the callbacks are all broken. > I don't think this needs to change. If you mean to say that you don't have to fix it in this series: yes, but it still needs fixing. If you don't want to fix it, consider adding a FIXME comment. > This fix is only about the case of unmatching devices that need to be > free within qpci_device_foreach(). > > Do you ack that fix? I'd be willing to.
Markus Armbruster <armbru@redhat.com> writes: > Marc-André Lureau <marcandre.lureau@gmail.com> writes: > >> Hi >> >> On Fri, Jan 29, 2016 at 4:43 PM, Markus Armbruster <armbru@redhat.com> wrote: >>> The existing users pass a func that saves dev, and free the saved dev >>> later. Works as long as we call func() at most once. If multiple >>> devices match, all but the last one are leaked. Can this happen? >> >> It is the responsability of the func() callback to deal with multiple >> matches. > > If that's the case, and multiple devices can match, then the callbacks > are all broken. > >> I don't think this needs to change. > > If you mean to say that you don't have to fix it in this series: yes, > but it still needs fixing. If you don't want to fix it, consider adding > a FIXME comment. I'll have some ivshmem work coming up, and will try to remember to include a fix for this. [...]
diff --git a/tests/libqos/pci.c b/tests/libqos/pci.c index 4e630c2..80b1a21 100644 --- a/tests/libqos/pci.c +++ b/tests/libqos/pci.c @@ -34,11 +34,13 @@ void qpci_device_foreach(QPCIBus *bus, int vendor_id, int device_id, if (vendor_id != -1 && qpci_config_readw(dev, PCI_VENDOR_ID) != vendor_id) { + g_free(dev); continue; } if (device_id != -1 && qpci_config_readw(dev, PCI_DEVICE_ID) != device_id) { + g_free(dev); continue; }