* [PATCH 0/3] mini-os: fix several double frees and memory leaks
@ 2020-04-09 14:12 Juergen Gross
2020-04-09 14:12 ` [PATCH 1/3] mini-os: fix double free() in netfront Juergen Gross
` (3 more replies)
0 siblings, 4 replies; 9+ messages in thread
From: Juergen Gross @ 2020-04-09 14:12 UTC (permalink / raw)
To: minios-devel, xen-devel; +Cc: Juergen Gross, samuel.thibault, wl
This series fixes two double free() introduced by suspend/resume
patches and several memory leaks.
Juergen Gross (3):
mini-os: fix double free() in netfront
mini-os: fix double free() in xenbus
mini-os: fix several memory leaks related to xenbus
blkfront.c | 4 ++--
console/xenbus.c | 2 +-
fbfront.c | 4 ++--
netfront.c | 4 +---
pcifront.c | 28 +++++++++++++---------------
shutdown.c | 2 +-
xenbus/xenbus.c | 8 ++++++--
7 files changed, 26 insertions(+), 26 deletions(-)
--
2.16.4
^ permalink raw reply [flat|nested] 9+ messages in thread* [PATCH 1/3] mini-os: fix double free() in netfront 2020-04-09 14:12 [PATCH 0/3] mini-os: fix several double frees and memory leaks Juergen Gross @ 2020-04-09 14:12 ` Juergen Gross 2020-04-09 14:33 ` Samuel Thibault 2020-04-09 14:12 ` [PATCH 2/3] mini-os: fix double free() in xenbus Juergen Gross ` (2 subsequent siblings) 3 siblings, 1 reply; 9+ messages in thread From: Juergen Gross @ 2020-04-09 14:12 UTC (permalink / raw) To: minios-devel, xen-devel; +Cc: Juergen Gross, samuel.thibault, wl Commit d225f4012d69a19 ("Save/Restore Support: Add suspend/restore support for netfront") introduced a regression in form of freeing a netfront device structure twice. Fix that. Coverity-ID: 1433637 Fixes: d225f4012d69a19 ("Save/Restore Support: Add suspend/restore support for netfront") Signed-off-by: Juergen Gross <jgross@suse.com> --- netfront.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/netfront.c b/netfront.c index 50b3a57..fe7bb62 100644 --- a/netfront.c +++ b/netfront.c @@ -584,8 +584,6 @@ void shutdown_netfront(struct netfront_dev *dev) list->refcount--; if (list->refcount == 0) { _shutdown_netfront(dev); - free(dev->nodename); - free(dev); to_del = list; if (to_del == dev_list) { -- 2.16.4 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH 1/3] mini-os: fix double free() in netfront 2020-04-09 14:12 ` [PATCH 1/3] mini-os: fix double free() in netfront Juergen Gross @ 2020-04-09 14:33 ` Samuel Thibault 0 siblings, 0 replies; 9+ messages in thread From: Samuel Thibault @ 2020-04-09 14:33 UTC (permalink / raw) To: Juergen Gross; +Cc: minios-devel, xen-devel, wl Juergen Gross, le jeu. 09 avril 2020 16:12:38 +0200, a ecrit: > Commit d225f4012d69a19 ("Save/Restore Support: Add suspend/restore > support for netfront") introduced a regression in form of freeing a > netfront device structure twice. > > Fix that. > > Coverity-ID: 1433637 > Fixes: d225f4012d69a19 ("Save/Restore Support: Add suspend/restore support for netfront") > Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> > --- > netfront.c | 2 -- > 1 file changed, 2 deletions(-) > > diff --git a/netfront.c b/netfront.c > index 50b3a57..fe7bb62 100644 > --- a/netfront.c > +++ b/netfront.c > @@ -584,8 +584,6 @@ void shutdown_netfront(struct netfront_dev *dev) > list->refcount--; > if (list->refcount == 0) { > _shutdown_netfront(dev); > - free(dev->nodename); > - free(dev); > > to_del = list; > if (to_del == dev_list) { > -- > 2.16.4 > ^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH 2/3] mini-os: fix double free() in xenbus 2020-04-09 14:12 [PATCH 0/3] mini-os: fix several double frees and memory leaks Juergen Gross 2020-04-09 14:12 ` [PATCH 1/3] mini-os: fix double free() in netfront Juergen Gross @ 2020-04-09 14:12 ` Juergen Gross 2020-04-09 14:34 ` Samuel Thibault 2020-04-09 14:12 ` [PATCH 3/3] mini-os: fix several memory leaks related to xenbus Juergen Gross 2020-04-09 14:30 ` [PATCH 0/3] mini-os: fix several double frees and memory leaks Wei Liu 3 siblings, 1 reply; 9+ messages in thread From: Juergen Gross @ 2020-04-09 14:12 UTC (permalink / raw) To: minios-devel, xen-devel; +Cc: Juergen Gross, samuel.thibault, wl Commit 973ad0c4de1b48 ("Save/Restore Support: Add suspend/restore support for xenbus") introduced a double free of some memory and leaked another memory allocation. Fix those. Coverity-ID: 1433640 Fixes: 973ad0c4de1b48 ("Save/Restore Support: Add suspend/restore support for xenbus") Signed-off-by: Juergen Gross <jgross@suse.com> --- xenbus/xenbus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/xenbus/xenbus.c b/xenbus/xenbus.c index d72dc3a..b12cef7 100644 --- a/xenbus/xenbus.c +++ b/xenbus/xenbus.c @@ -413,9 +413,11 @@ void resume_xenbus(int canceled) rep = xenbus_msg_reply(XS_WATCH, XBT_NIL, req, ARRAY_SIZE(req)); msg = errmsg(rep); - if (msg) + if (msg) { xprintk("error on XS_WATCH: %s\n", msg); - free(rep); + free(msg); + } else + free(rep); } } -- 2.16.4 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH 2/3] mini-os: fix double free() in xenbus 2020-04-09 14:12 ` [PATCH 2/3] mini-os: fix double free() in xenbus Juergen Gross @ 2020-04-09 14:34 ` Samuel Thibault 0 siblings, 0 replies; 9+ messages in thread From: Samuel Thibault @ 2020-04-09 14:34 UTC (permalink / raw) To: Juergen Gross; +Cc: minios-devel, xen-devel, wl Juergen Gross, le jeu. 09 avril 2020 16:12:39 +0200, a ecrit: > Commit 973ad0c4de1b48 ("Save/Restore Support: Add suspend/restore > support for xenbus") introduced a double free of some memory and leaked > another memory allocation. > > Fix those. > > Coverity-ID: 1433640 > Fixes: 973ad0c4de1b48 ("Save/Restore Support: Add suspend/restore support for xenbus") > Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> > --- > xenbus/xenbus.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/xenbus/xenbus.c b/xenbus/xenbus.c > index d72dc3a..b12cef7 100644 > --- a/xenbus/xenbus.c > +++ b/xenbus/xenbus.c > @@ -413,9 +413,11 @@ void resume_xenbus(int canceled) > > rep = xenbus_msg_reply(XS_WATCH, XBT_NIL, req, ARRAY_SIZE(req)); > msg = errmsg(rep); > - if (msg) > + if (msg) { > xprintk("error on XS_WATCH: %s\n", msg); > - free(rep); > + free(msg); > + } else > + free(rep); > } > } > > -- > 2.16.4 > ^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH 3/3] mini-os: fix several memory leaks related to xenbus 2020-04-09 14:12 [PATCH 0/3] mini-os: fix several double frees and memory leaks Juergen Gross 2020-04-09 14:12 ` [PATCH 1/3] mini-os: fix double free() in netfront Juergen Gross 2020-04-09 14:12 ` [PATCH 2/3] mini-os: fix double free() in xenbus Juergen Gross @ 2020-04-09 14:12 ` Juergen Gross 2020-04-09 14:35 ` Samuel Thibault 2020-04-09 14:30 ` [PATCH 0/3] mini-os: fix several double frees and memory leaks Wei Liu 3 siblings, 1 reply; 9+ messages in thread From: Juergen Gross @ 2020-04-09 14:12 UTC (permalink / raw) To: minios-devel, xen-devel; +Cc: Juergen Gross, samuel.thibault, wl There are several instances of calls to xenbus functions which don't test for an error and in consequence are not freeing the returned error strings, or which are just not freeing the string after e.g. printing it. Fix that by either adding the needed calls of free(). Coverity-ID: 1433632 Signed-off-by: Juergen Gross <jgross@suse.com> --- blkfront.c | 4 ++-- console/xenbus.c | 2 +- fbfront.c | 4 ++-- netfront.c | 2 +- pcifront.c | 28 +++++++++++++--------------- shutdown.c | 2 +- xenbus/xenbus.c | 2 ++ 7 files changed, 22 insertions(+), 22 deletions(-) diff --git a/blkfront.c b/blkfront.c index f747216..834a978 100644 --- a/blkfront.c +++ b/blkfront.c @@ -200,7 +200,7 @@ done: snprintf(path, sizeof(path), "%s/state", dev->backend); - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); msg = NULL; state = xenbus_read_integer(path); @@ -208,7 +208,7 @@ done: msg = xenbus_wait_for_state_change(path, &state, &dev->events); if (msg != NULL || state != XenbusStateConnected) { printk("backend not available, state=%d\n", state); - xenbus_unwatch_path_token(XBT_NIL, path, path); + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); goto error; } diff --git a/console/xenbus.c b/console/xenbus.c index 654b469..05fc31c 100644 --- a/console/xenbus.c +++ b/console/xenbus.c @@ -164,7 +164,7 @@ done: char path[strlen(dev->backend) + strlen("/state") + 1]; snprintf(path, sizeof(path), "%s/state", dev->backend); - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); msg = NULL; state = xenbus_read_integer(path); while (msg == NULL && state < XenbusStateConnected) diff --git a/fbfront.c b/fbfront.c index 9cc07b4..d3b3848 100644 --- a/fbfront.c +++ b/fbfront.c @@ -163,7 +163,7 @@ done: snprintf(path, sizeof(path), "%s/state", dev->backend); - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); err = NULL; state = xenbus_read_integer(path); @@ -530,7 +530,7 @@ done: snprintf(path, sizeof(path), "%s/state", dev->backend); - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); err = NULL; state = xenbus_read_integer(path); diff --git a/netfront.c b/netfront.c index fe7bb62..66f2bbc 100644 --- a/netfront.c +++ b/netfront.c @@ -513,7 +513,7 @@ done: err = xenbus_wait_for_state_change(path, &state, &dev->events); if (state != XenbusStateConnected) { printk("backend not avalable, state=%d\n", state); - xenbus_unwatch_path_token(XBT_NIL, path, path); + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); goto error; } diff --git a/pcifront.c b/pcifront.c index 0fc5b30..5642356 100644 --- a/pcifront.c +++ b/pcifront.c @@ -70,28 +70,28 @@ void pcifront_watches(void *opaque) while (1) { printk("pcifront_watches: waiting for backend path to appear %s\n", path); - xenbus_watch_path_token(XBT_NIL, path, path, &events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &events)); while ((err = xenbus_read(XBT_NIL, path, &be_path)) != NULL) { free(err); xenbus_wait_for_watch(&events); } - xenbus_unwatch_path_token(XBT_NIL, path, path); + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); printk("pcifront_watches: waiting for backend to get into the right state %s\n", be_path); be_state = (char *) malloc(strlen(be_path) + 7); snprintf(be_state, strlen(be_path) + 7, "%s/state", be_path); - xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events); + free(xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events)); while ((err = xenbus_read(XBT_NIL, be_state, &msg)) != NULL || msg[0] > '4') { free(msg); free(err); xenbus_wait_for_watch(&events); } - xenbus_unwatch_path_token(XBT_NIL, be_state, be_state); + free(xenbus_unwatch_path_token(XBT_NIL, be_state, be_state)); if (init_pcifront(NULL) == NULL) { free(be_state); free(be_path); continue; } - xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events); + free(xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events)); state = XenbusStateConnected; printk("pcifront_watches: waiting for backend events %s\n", be_state); while ((err = xenbus_wait_for_state_change(be_state, &state, &events)) == NULL && @@ -103,10 +103,9 @@ void pcifront_watches(void *opaque) if ((err = xenbus_switch_state(XBT_NIL, fe_state, XenbusStateReconfiguring)) != NULL) { printk("pcifront_watches: error changing state to %d: %s\n", XenbusStateReconfiguring, err); - if (!strcmp(err, "ENOENT")) { - xenbus_write(XBT_NIL, fe_state, "7"); - free(err); - } + if (!strcmp(err, "ENOENT")) + free(xenbus_write(XBT_NIL, fe_state, "7")); + free(err); } } else if (state == XenbusStateReconfigured) { printk("pcifront_watches: writing %s %d\n", fe_state, XenbusStateConnected); @@ -114,10 +113,9 @@ void pcifront_watches(void *opaque) if ((err = xenbus_switch_state(XBT_NIL, fe_state, XenbusStateConnected)) != NULL) { printk("pcifront_watches: error changing state to %d: %s\n", XenbusStateConnected, err); - if (!strcmp(err, "ENOENT")) { - xenbus_write(XBT_NIL, fe_state, "4"); - free(err); - } + if (!strcmp(err, "ENOENT")) + free(xenbus_write(XBT_NIL, fe_state, "4")); + free(err); } } else if (state == XenbusStateClosing) break; @@ -135,7 +133,7 @@ void pcifront_watches(void *opaque) pcidev = NULL; } - xenbus_unwatch_path_token(XBT_NIL, path, path); + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); } struct pcifront_dev *init_pcifront(char *_nodename) @@ -243,7 +241,7 @@ done: XenbusState state; snprintf(path, sizeof(path), "%s/state", dev->backend); - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); err = NULL; state = xenbus_read_integer(path); diff --git a/shutdown.c b/shutdown.c index c7c92cb..4c0b13c 100644 --- a/shutdown.c +++ b/shutdown.c @@ -71,7 +71,7 @@ static void shutdown_thread(void *p) char *shutdown, *err; unsigned int shutdown_reason; - xenbus_watch_path_token(XBT_NIL, path, token, &events); + free(xenbus_watch_path_token(XBT_NIL, path, token, &events)); for ( ;; ) { xenbus_wait_for_watch(&events); diff --git a/xenbus/xenbus.c b/xenbus/xenbus.c index b12cef7..9e61930 100644 --- a/xenbus/xenbus.c +++ b/xenbus/xenbus.c @@ -198,6 +198,8 @@ exit: } if (msg == NULL && msg2 != NULL) msg = msg2; + else + free(msg2); } while (retry); return msg; -- 2.16.4 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH 3/3] mini-os: fix several memory leaks related to xenbus 2020-04-09 14:12 ` [PATCH 3/3] mini-os: fix several memory leaks related to xenbus Juergen Gross @ 2020-04-09 14:35 ` Samuel Thibault 2020-04-09 14:46 ` Wei Liu 0 siblings, 1 reply; 9+ messages in thread From: Samuel Thibault @ 2020-04-09 14:35 UTC (permalink / raw) To: Juergen Gross; +Cc: minios-devel, xen-devel, wl Juergen Gross, le jeu. 09 avril 2020 16:12:40 +0200, a ecrit: > There are several instances of calls to xenbus functions which don't > test for an error and in consequence are not freeing the returned > error strings, or which are just not freeing the string after e.g. > printing it. > > Fix that by either adding the needed calls of free(). > > Coverity-ID: 1433632 > Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> > --- > blkfront.c | 4 ++-- > console/xenbus.c | 2 +- > fbfront.c | 4 ++-- > netfront.c | 2 +- > pcifront.c | 28 +++++++++++++--------------- > shutdown.c | 2 +- > xenbus/xenbus.c | 2 ++ > 7 files changed, 22 insertions(+), 22 deletions(-) > > diff --git a/blkfront.c b/blkfront.c > index f747216..834a978 100644 > --- a/blkfront.c > +++ b/blkfront.c > @@ -200,7 +200,7 @@ done: > > snprintf(path, sizeof(path), "%s/state", dev->backend); > > - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); > + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); > > msg = NULL; > state = xenbus_read_integer(path); > @@ -208,7 +208,7 @@ done: > msg = xenbus_wait_for_state_change(path, &state, &dev->events); > if (msg != NULL || state != XenbusStateConnected) { > printk("backend not available, state=%d\n", state); > - xenbus_unwatch_path_token(XBT_NIL, path, path); > + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); > goto error; > } > > diff --git a/console/xenbus.c b/console/xenbus.c > index 654b469..05fc31c 100644 > --- a/console/xenbus.c > +++ b/console/xenbus.c > @@ -164,7 +164,7 @@ done: > char path[strlen(dev->backend) + strlen("/state") + 1]; > snprintf(path, sizeof(path), "%s/state", dev->backend); > > - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); > + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); > msg = NULL; > state = xenbus_read_integer(path); > while (msg == NULL && state < XenbusStateConnected) > diff --git a/fbfront.c b/fbfront.c > index 9cc07b4..d3b3848 100644 > --- a/fbfront.c > +++ b/fbfront.c > @@ -163,7 +163,7 @@ done: > > snprintf(path, sizeof(path), "%s/state", dev->backend); > > - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); > + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); > > err = NULL; > state = xenbus_read_integer(path); > @@ -530,7 +530,7 @@ done: > > snprintf(path, sizeof(path), "%s/state", dev->backend); > > - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); > + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); > > err = NULL; > state = xenbus_read_integer(path); > diff --git a/netfront.c b/netfront.c > index fe7bb62..66f2bbc 100644 > --- a/netfront.c > +++ b/netfront.c > @@ -513,7 +513,7 @@ done: > err = xenbus_wait_for_state_change(path, &state, &dev->events); > if (state != XenbusStateConnected) { > printk("backend not avalable, state=%d\n", state); > - xenbus_unwatch_path_token(XBT_NIL, path, path); > + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); > goto error; > } > > diff --git a/pcifront.c b/pcifront.c > index 0fc5b30..5642356 100644 > --- a/pcifront.c > +++ b/pcifront.c > @@ -70,28 +70,28 @@ void pcifront_watches(void *opaque) > > while (1) { > printk("pcifront_watches: waiting for backend path to appear %s\n", path); > - xenbus_watch_path_token(XBT_NIL, path, path, &events); > + free(xenbus_watch_path_token(XBT_NIL, path, path, &events)); > while ((err = xenbus_read(XBT_NIL, path, &be_path)) != NULL) { > free(err); > xenbus_wait_for_watch(&events); > } > - xenbus_unwatch_path_token(XBT_NIL, path, path); > + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); > printk("pcifront_watches: waiting for backend to get into the right state %s\n", be_path); > be_state = (char *) malloc(strlen(be_path) + 7); > snprintf(be_state, strlen(be_path) + 7, "%s/state", be_path); > - xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events); > + free(xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events)); > while ((err = xenbus_read(XBT_NIL, be_state, &msg)) != NULL || msg[0] > '4') { > free(msg); > free(err); > xenbus_wait_for_watch(&events); > } > - xenbus_unwatch_path_token(XBT_NIL, be_state, be_state); > + free(xenbus_unwatch_path_token(XBT_NIL, be_state, be_state)); > if (init_pcifront(NULL) == NULL) { > free(be_state); > free(be_path); > continue; > } > - xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events); > + free(xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events)); > state = XenbusStateConnected; > printk("pcifront_watches: waiting for backend events %s\n", be_state); > while ((err = xenbus_wait_for_state_change(be_state, &state, &events)) == NULL && > @@ -103,10 +103,9 @@ void pcifront_watches(void *opaque) > if ((err = xenbus_switch_state(XBT_NIL, fe_state, XenbusStateReconfiguring)) != NULL) { > printk("pcifront_watches: error changing state to %d: %s\n", > XenbusStateReconfiguring, err); > - if (!strcmp(err, "ENOENT")) { > - xenbus_write(XBT_NIL, fe_state, "7"); > - free(err); > - } > + if (!strcmp(err, "ENOENT")) > + free(xenbus_write(XBT_NIL, fe_state, "7")); > + free(err); > } > } else if (state == XenbusStateReconfigured) { > printk("pcifront_watches: writing %s %d\n", fe_state, XenbusStateConnected); > @@ -114,10 +113,9 @@ void pcifront_watches(void *opaque) > if ((err = xenbus_switch_state(XBT_NIL, fe_state, XenbusStateConnected)) != NULL) { > printk("pcifront_watches: error changing state to %d: %s\n", > XenbusStateConnected, err); > - if (!strcmp(err, "ENOENT")) { > - xenbus_write(XBT_NIL, fe_state, "4"); > - free(err); > - } > + if (!strcmp(err, "ENOENT")) > + free(xenbus_write(XBT_NIL, fe_state, "4")); > + free(err); > } > } else if (state == XenbusStateClosing) > break; > @@ -135,7 +133,7 @@ void pcifront_watches(void *opaque) > pcidev = NULL; > } > > - xenbus_unwatch_path_token(XBT_NIL, path, path); > + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); > } > > struct pcifront_dev *init_pcifront(char *_nodename) > @@ -243,7 +241,7 @@ done: > XenbusState state; > snprintf(path, sizeof(path), "%s/state", dev->backend); > > - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); > + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); > > err = NULL; > state = xenbus_read_integer(path); > diff --git a/shutdown.c b/shutdown.c > index c7c92cb..4c0b13c 100644 > --- a/shutdown.c > +++ b/shutdown.c > @@ -71,7 +71,7 @@ static void shutdown_thread(void *p) > char *shutdown, *err; > unsigned int shutdown_reason; > > - xenbus_watch_path_token(XBT_NIL, path, token, &events); > + free(xenbus_watch_path_token(XBT_NIL, path, token, &events)); > > for ( ;; ) { > xenbus_wait_for_watch(&events); > diff --git a/xenbus/xenbus.c b/xenbus/xenbus.c > index b12cef7..9e61930 100644 > --- a/xenbus/xenbus.c > +++ b/xenbus/xenbus.c > @@ -198,6 +198,8 @@ exit: > } > if (msg == NULL && msg2 != NULL) > msg = msg2; > + else > + free(msg2); > } while (retry); > > return msg; > -- > 2.16.4 > ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 3/3] mini-os: fix several memory leaks related to xenbus 2020-04-09 14:35 ` Samuel Thibault @ 2020-04-09 14:46 ` Wei Liu 0 siblings, 0 replies; 9+ messages in thread From: Wei Liu @ 2020-04-09 14:46 UTC (permalink / raw) To: Samuel Thibault, Juergen Gross, minios-devel, xen-devel, wl On Thu, Apr 09, 2020 at 04:35:27PM +0200, Samuel Thibault wrote: > Juergen Gross, le jeu. 09 avril 2020 16:12:40 +0200, a ecrit: > > There are several instances of calls to xenbus functions which don't > > test for an error and in consequence are not freeing the returned > > error strings, or which are just not freeing the string after e.g. > > printing it. > > > > Fix that by either adding the needed calls of free(). > > > > Coverity-ID: 1433632 > > Signed-off-by: Juergen Gross <jgross@suse.com> > > Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Thanks for your review, Samuel. I have pushed these patches with your Rbs. Wei. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 0/3] mini-os: fix several double frees and memory leaks 2020-04-09 14:12 [PATCH 0/3] mini-os: fix several double frees and memory leaks Juergen Gross ` (2 preceding siblings ...) 2020-04-09 14:12 ` [PATCH 3/3] mini-os: fix several memory leaks related to xenbus Juergen Gross @ 2020-04-09 14:30 ` Wei Liu 3 siblings, 0 replies; 9+ messages in thread From: Wei Liu @ 2020-04-09 14:30 UTC (permalink / raw) To: Juergen Gross; +Cc: minios-devel, xen-devel, wl, samuel.thibault On Thu, Apr 09, 2020 at 04:12:37PM +0200, Juergen Gross wrote: > This series fixes two double free() introduced by suspend/resume > patches and several memory leaks. > > Juergen Gross (3): > mini-os: fix double free() in netfront > mini-os: fix double free() in xenbus > mini-os: fix several memory leaks related to xenbus Acked-by: Wei Liu <wl@xen.org> Thanks for fixing these bugs. ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2020-04-09 14:46 UTC | newest] Thread overview: 9+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2020-04-09 14:12 [PATCH 0/3] mini-os: fix several double frees and memory leaks Juergen Gross 2020-04-09 14:12 ` [PATCH 1/3] mini-os: fix double free() in netfront Juergen Gross 2020-04-09 14:33 ` Samuel Thibault 2020-04-09 14:12 ` [PATCH 2/3] mini-os: fix double free() in xenbus Juergen Gross 2020-04-09 14:34 ` Samuel Thibault 2020-04-09 14:12 ` [PATCH 3/3] mini-os: fix several memory leaks related to xenbus Juergen Gross 2020-04-09 14:35 ` Samuel Thibault 2020-04-09 14:46 ` Wei Liu 2020-04-09 14:30 ` [PATCH 0/3] mini-os: fix several double frees and memory leaks Wei Liu
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.