| From foo@baz Mon 27 Jan 2020 04:06:27 PM CET |
| From: Wenwen Wang <wenwen@cs.uga.edu> |
| Date: Sat, 25 Jan 2020 14:33:29 +0000 |
| Subject: firestream: fix memory leaks |
| |
| From: Wenwen Wang <wenwen@cs.uga.edu> |
| |
| [ Upstream commit fa865ba183d61c1ec8cbcab8573159c3b72b89a4 ] |
| |
| In fs_open(), 'vcc' is allocated through kmalloc() and assigned to |
| 'atm_vcc->dev_data.' In the following execution, if an error occurs, e.g., |
| there is no more free channel, an error code EBUSY or ENOMEM will be |
| returned. However, 'vcc' is not deallocated, leading to memory leaks. Note |
| that, in normal cases where fs_open() returns 0, 'vcc' will be deallocated |
| in fs_close(). But, if fs_open() fails, there is no guarantee that |
| fs_close() will be invoked. |
| |
| To fix this issue, deallocate 'vcc' before the error code is returned. |
| |
| Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/atm/firestream.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/drivers/atm/firestream.c |
| +++ b/drivers/atm/firestream.c |
| @@ -927,6 +927,7 @@ static int fs_open(struct atm_vcc *atm_v |
| } |
| if (!to) { |
| printk ("No more free channels for FS50..\n"); |
| + kfree(vcc); |
| return -EBUSY; |
| } |
| vcc->channo = dev->channo; |
| @@ -937,6 +938,7 @@ static int fs_open(struct atm_vcc *atm_v |
| if (((DO_DIRECTION(rxtp) && dev->atm_vccs[vcc->channo])) || |
| ( DO_DIRECTION(txtp) && test_bit (vcc->channo, dev->tx_inuse))) { |
| printk ("Channel is in use for FS155.\n"); |
| + kfree(vcc); |
| return -EBUSY; |
| } |
| } |
| @@ -950,6 +952,7 @@ static int fs_open(struct atm_vcc *atm_v |
| tc, sizeof (struct fs_transmit_config)); |
| if (!tc) { |
| fs_dprintk (FS_DEBUG_OPEN, "fs: can't alloc transmit_config.\n"); |
| + kfree(vcc); |
| return -ENOMEM; |
| } |
| |