diff mbox

batman-adv: Fix mem leak in the batadv_tt_local_event() function

Message ID alpine.LNX.2.00.1208072030500.3227@swampdragon.chaosbits.net
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Jesper Juhl Aug. 7, 2012, 6:32 p.m. UTC
Memory is allocated for 'tt_change_node' with kmalloc().
'tt_change_node' may go out of scope really being used for anything
(except have a few members initialized) if we hit the 'del:' label.
This patch makes sure we free the memory in that case.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
---
 net/batman-adv/translation-table.c | 1 +
 1 file changed, 1 insertion(+)

 Compile tested only.

Comments

Jesper Juhl Aug. 7, 2012, 6:38 p.m. UTC | #1
On Tue, 7 Aug 2012, Jesper Juhl wrote:

> Memory is allocated for 'tt_change_node' with kmalloc().
> 'tt_change_node' may go out of scope really being used for anything

This should of course read "... go out of scope without really being used ..." .

> (except have a few members initialized) if we hit the 'del:' label.
> This patch makes sure we free the memory in that case.
> 
> Signed-off-by: Jesper Juhl <jj@chaosbits.net>
> ---
>  net/batman-adv/translation-table.c | 1 +
>  1 file changed, 1 insertion(+)
> 
>  Compile tested only.
> 
> diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
> index a438f4b..99dd8f7 100644
> --- a/net/batman-adv/translation-table.c
> +++ b/net/batman-adv/translation-table.c
> @@ -197,6 +197,7 @@ static void batadv_tt_local_event(struct batadv_priv *bat_priv,
>  del:
>  		list_del(&entry->list);
>  		kfree(entry);
> +		kfree(tt_change_node);
>  		event_removed = true;
>  		goto unlock;
>  	}
>
Antonio Quartulli Aug. 7, 2012, 6:50 p.m. UTC | #2
On Tue, Aug 07, 2012 at 08:32:34PM +0200, Jesper Juhl wrote:
> Memory is allocated for 'tt_change_node' with kmalloc().
> 'tt_change_node' may go out of scope really being used for anything
> (except have a few members initialized) if we hit the 'del:' label.
> This patch makes sure we free the memory in that case.
> 
> Signed-off-by: Jesper Juhl <jj@chaosbits.net>

Acked-by: Antonio Quartulli <ordex@autistici.org>


Thank you very much Jepser!
David Miller Aug. 8, 2012, 11:04 p.m. UTC | #3
From: Antonio Quartulli <ordex@autistici.org>
Date: Tue, 7 Aug 2012 20:50:36 +0200

> On Tue, Aug 07, 2012 at 08:32:34PM +0200, Jesper Juhl wrote:
>> Memory is allocated for 'tt_change_node' with kmalloc().
>> 'tt_change_node' may go out of scope really being used for anything
>> (except have a few members initialized) if we hit the 'del:' label.
>> This patch makes sure we free the memory in that case.
>> 
>> Signed-off-by: Jesper Juhl <jj@chaosbits.net>
> 
> Acked-by: Antonio Quartulli <ordex@autistici.org>

Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index a438f4b..99dd8f7 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -197,6 +197,7 @@  static void batadv_tt_local_event(struct batadv_priv *bat_priv,
 del:
 		list_del(&entry->list);
 		kfree(entry);
+		kfree(tt_change_node);
 		event_removed = true;
 		goto unlock;
 	}