| Message ID | 20231010204348.2600242-3-ninad@linux.ibm.com |
|---|---|
| State | New |
| Headers | show |
| Series | fsi: sbefifo: fixes | expand |
On 10/10/23 15:43, Ninad Palsule wrote: > If previous write command is still pending then free it first. > > As per the current kernel driver design, write operation prepares a > buffer for FSI write, the actual FSI write is performed on next read > operation. There is a possibility of memory leak if buggy application > sends two back to back writes or two parallel writes. Reviewed-by: Eddie James <eajames@linux.ibm.com> > > Signed-off-by: Ninad Palsule <ninad@linux.ibm.com> > --- > v3: > - Incorporated review comments by Eddie. > --- > drivers/fsi/fsi-sbefifo.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c > index a95b32461f8f3..1cc88a78e588a 100644 > --- a/drivers/fsi/fsi-sbefifo.c > +++ b/drivers/fsi/fsi-sbefifo.c > @@ -877,6 +877,13 @@ static ssize_t sbefifo_user_write(struct file *file, const char __user *buf, > > mutex_lock(&user->file_lock); > > + /* If previous write command is still pending then free it. It is safe > + * to do that because read cannot be in progress since we hold the > + * lock. > + */ > + if (user->pending_cmd) > + sbefifo_release_command(user); > + > /* Can we use the pre-allocate buffer ? If not, allocate */ > if (len <= PAGE_SIZE) > user->pending_cmd = user->cmd_page;
diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c index a95b32461f8f3..1cc88a78e588a 100644 --- a/drivers/fsi/fsi-sbefifo.c +++ b/drivers/fsi/fsi-sbefifo.c @@ -877,6 +877,13 @@ static ssize_t sbefifo_user_write(struct file *file, const char __user *buf, mutex_lock(&user->file_lock); + /* If previous write command is still pending then free it. It is safe + * to do that because read cannot be in progress since we hold the + * lock. + */ + if (user->pending_cmd) + sbefifo_release_command(user); + /* Can we use the pre-allocate buffer ? If not, allocate */ if (len <= PAGE_SIZE) user->pending_cmd = user->cmd_page;
If previous write command is still pending then free it first. As per the current kernel driver design, write operation prepares a buffer for FSI write, the actual FSI write is performed on next read operation. There is a possibility of memory leak if buggy application sends two back to back writes or two parallel writes. Signed-off-by: Ninad Palsule <ninad@linux.ibm.com> --- v3: - Incorporated review comments by Eddie. --- drivers/fsi/fsi-sbefifo.c | 7 +++++++ 1 file changed, 7 insertions(+)