All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] linux-2.6.18/blkback: do not leak mode property
@ 2012-12-13 14:58 Jan Beulich
  2012-12-13 15:09 ` Olaf Hering
  0 siblings, 1 reply; 3+ messages in thread
From: Jan Beulich @ 2012-12-13 14:58 UTC (permalink / raw)
  To: xen-devel; +Cc: Olaf Hering

[-- Attachment #1: Type: text/plain, Size: 2948 bytes --]

"be->mode" is obtained from xenbus_read(), which does a kmalloc() for
the message body. The short string is never released, so do it along
with freeing "be" itself, and make sure the string isn't kept when
backend_changed() doesn't complete successfully (which made it
desirable to slightly re-structure that function, so that the error
cleanup can be done in one place).

Reported-by: Olaf Hering <olaf@aepfle.de>
Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/drivers/xen/blkback/xenbus.c
+++ b/drivers/xen/blkback/xenbus.c
@@ -198,6 +198,7 @@ static int blkback_remove(struct xenbus_
 		be->blkif = NULL;
 	}
 
+	kfree(be->mode);
 	kfree(be);
 	dev->dev.driver_data = NULL;
 	write_unlock(&sysfs_read_lock);
@@ -278,6 +279,7 @@ static void backend_changed(struct xenbu
 		= container_of(watch, struct backend_info, backend_watch);
 	struct xenbus_device *dev = be->dev;
 	int cdrom = 0;
+	unsigned long handle;
 	char *device_type;
 
 	DPRINTK("");
@@ -295,12 +297,12 @@ static void backend_changed(struct xenbu
 		return;
 	}
 
-	if ((be->major || be->minor) &&
-	    ((be->major != major) || (be->minor != minor))) {
-		printk(KERN_WARNING
-		       "blkback: changing physical device (from %x:%x to "
-		       "%x:%x) not supported.\n", be->major, be->minor,
-		       major, minor);
+	if (be->major | be->minor) {
+		if (be->major != major || be->minor != minor)
+			printk(KERN_WARNING "blkback: "
+			       "changing physical device (from %x:%x to "
+			       "%x:%x) not supported.\n",
+			       be->major, be->minor, major, minor);
 		return;
 	}
 
@@ -318,31 +320,30 @@ static void backend_changed(struct xenbu
 		kfree(device_type);
 	}
 
-	if (be->major == 0 && be->minor == 0) {
-		/* Front end dir is a number, which is used as the handle. */
+	/* Front end dir is a number, which is used as the handle. */
+	handle = simple_strtoul(strrchr(dev->otherend, '/') + 1, NULL, 0);
 
-		char *p = strrchr(dev->otherend, '/') + 1;
-		long handle = simple_strtoul(p, NULL, 0);
+	be->major = major;
+	be->minor = minor;
 
-		be->major = major;
-		be->minor = minor;
-
-		err = vbd_create(be->blkif, handle, major, minor,
-				 (NULL == strchr(be->mode, 'w')), cdrom);
-		if (err) {
-			be->major = be->minor = 0;
-			xenbus_dev_fatal(dev, err, "creating vbd structure");
-			return;
-		}
+	err = vbd_create(be->blkif, handle, major, minor,
+			 (NULL == strchr(be->mode, 'w')), cdrom);
 
+	if (err)
+		xenbus_dev_fatal(dev, err, "creating vbd structure");
+	else {
 		err = xenvbd_sysfs_addif(dev);
 		if (err) {
 			vbd_free(&be->blkif->vbd);
-			be->major = be->minor = 0;
 			xenbus_dev_fatal(dev, err, "creating sysfs entries");
-			return;
 		}
+	}
 
+	if (err) {
+		kfree(be->mode);
+		be->mode = NULL;
+		be->major = be->minor = 0;
+	} else {
 		/* We're potentially connected now */
 		update_blkif_status(be->blkif);
 	}




[-- Attachment #2: xen-blkback-mode-leak.patch --]
[-- Type: text/plain, Size: 2980 bytes --]

blkback: do not leak mode property

"be->mode" is obtained from xenbus_read(), which does a kmalloc() for
the message body. The short string is never released, so do it along
with freeing "be" itself, and make sure the string isn't kept when
backend_changed() doesn't complete successfully (which made it
desirable to slightly re-structure that function, so that the error
cleanup can be done in one place).

Reported-by: Olaf Hering <olaf@aepfle.de>
Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/drivers/xen/blkback/xenbus.c
+++ b/drivers/xen/blkback/xenbus.c
@@ -198,6 +198,7 @@ static int blkback_remove(struct xenbus_
 		be->blkif = NULL;
 	}
 
+	kfree(be->mode);
 	kfree(be);
 	dev->dev.driver_data = NULL;
 	write_unlock(&sysfs_read_lock);
@@ -278,6 +279,7 @@ static void backend_changed(struct xenbu
 		= container_of(watch, struct backend_info, backend_watch);
 	struct xenbus_device *dev = be->dev;
 	int cdrom = 0;
+	unsigned long handle;
 	char *device_type;
 
 	DPRINTK("");
@@ -295,12 +297,12 @@ static void backend_changed(struct xenbu
 		return;
 	}
 
-	if ((be->major || be->minor) &&
-	    ((be->major != major) || (be->minor != minor))) {
-		printk(KERN_WARNING
-		       "blkback: changing physical device (from %x:%x to "
-		       "%x:%x) not supported.\n", be->major, be->minor,
-		       major, minor);
+	if (be->major | be->minor) {
+		if (be->major != major || be->minor != minor)
+			printk(KERN_WARNING "blkback: "
+			       "changing physical device (from %x:%x to "
+			       "%x:%x) not supported.\n",
+			       be->major, be->minor, major, minor);
 		return;
 	}
 
@@ -318,31 +320,30 @@ static void backend_changed(struct xenbu
 		kfree(device_type);
 	}
 
-	if (be->major == 0 && be->minor == 0) {
-		/* Front end dir is a number, which is used as the handle. */
+	/* Front end dir is a number, which is used as the handle. */
+	handle = simple_strtoul(strrchr(dev->otherend, '/') + 1, NULL, 0);
 
-		char *p = strrchr(dev->otherend, '/') + 1;
-		long handle = simple_strtoul(p, NULL, 0);
+	be->major = major;
+	be->minor = minor;
 
-		be->major = major;
-		be->minor = minor;
-
-		err = vbd_create(be->blkif, handle, major, minor,
-				 (NULL == strchr(be->mode, 'w')), cdrom);
-		if (err) {
-			be->major = be->minor = 0;
-			xenbus_dev_fatal(dev, err, "creating vbd structure");
-			return;
-		}
+	err = vbd_create(be->blkif, handle, major, minor,
+			 (NULL == strchr(be->mode, 'w')), cdrom);
 
+	if (err)
+		xenbus_dev_fatal(dev, err, "creating vbd structure");
+	else {
 		err = xenvbd_sysfs_addif(dev);
 		if (err) {
 			vbd_free(&be->blkif->vbd);
-			be->major = be->minor = 0;
 			xenbus_dev_fatal(dev, err, "creating sysfs entries");
-			return;
 		}
+	}
 
+	if (err) {
+		kfree(be->mode);
+		be->mode = NULL;
+		be->major = be->minor = 0;
+	} else {
 		/* We're potentially connected now */
 		update_blkif_status(be->blkif);
 	}

[-- Attachment #3: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] linux-2.6.18/blkback: do not leak mode property
  2012-12-13 14:58 [PATCH] linux-2.6.18/blkback: do not leak mode property Jan Beulich
@ 2012-12-13 15:09 ` Olaf Hering
  2012-12-13 15:13   ` Jan Beulich
  0 siblings, 1 reply; 3+ messages in thread
From: Olaf Hering @ 2012-12-13 15:09 UTC (permalink / raw)
  To: Jan Beulich; +Cc: xen-devel

On Thu, Dec 13, Jan Beulich wrote:

> +	if (be->major | be->minor) {

I think a single | works as intended, but || was meant?

Olaf

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] linux-2.6.18/blkback: do not leak mode property
  2012-12-13 15:09 ` Olaf Hering
@ 2012-12-13 15:13   ` Jan Beulich
  0 siblings, 0 replies; 3+ messages in thread
From: Jan Beulich @ 2012-12-13 15:13 UTC (permalink / raw)
  To: Olaf Hering; +Cc: xen-devel

>>> On 13.12.12 at 16:09, Olaf Hering <olaf@aepfle.de> wrote:
> On Thu, Dec 13, Jan Beulich wrote:
> 
>> +	if (be->major | be->minor) {
> 
> I think a single | works as intended, but || was meant?

No, I indeed meant to use | (as producing better code even with
a compiler not knowing of that transformation).

Jan

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2012-12-13 15:13 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-12-13 14:58 [PATCH] linux-2.6.18/blkback: do not leak mode property Jan Beulich
2012-12-13 15:09 ` Olaf Hering
2012-12-13 15:13   ` Jan Beulich

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.