[PATCH] dm: Fixes memory leak in setup_indexes function

[PATCH] dm: Fixes memory leak in setup_indexes function

[Shahzad Hussain Bangash]

[-- Attachment #1: Type: text/plain, Size: 235 bytes --]

Sorry for multiple patches. This patch fixes memory leak in
setup_indexes function where memory is allocated for indexes pointer by
dm_vcalloc with the size of NODE_size and is not freed after that
through the end of the function.


 

[-- Attachment #2: 0001-Fixes-memory-leak-in-setup_indexes.patch --]
[-- Type: text/x-patch, Size: 1225 bytes --]

From 57da07e6847cedd14d54ba1675264377846a026c Mon Sep 17 00:00:00 2001
From: Shahzad Bangash <ext-shahzad.bangash@nokia.com>
Date: Tue, 3 Aug 2010 13:58:48 +0300
Subject: [PATCH] dm: Fixes memory leak in setup_indexes function
"indexes" pointer in setup_indexes function is not freed. 
Signed-off-by: Shahzad Bangash <ext-shahzad.bangash@nokia.com>
---
 drivers/md/dm-table.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index e869128..05691f2 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -876,7 +876,7 @@ static int setup_indexes(struct dm_table *t)
 {
 	int i;
 	unsigned int total = 0;
-	sector_t *indexes;
+	sector_t *indexes, *indexes_head;
 
 	/* allocate the space for *all* the indexes */
 	for (i = t->depth - 2; i >= 0; i--) {
@@ -888,6 +888,8 @@ static int setup_indexes(struct dm_table *t)
 	if (!indexes)
 		return -ENOMEM;
 
+	indexes_head = indexes;
+
 	/* set up internal nodes, bottom-up */
 	for (i = t->depth - 2; i >= 0; i--) {
 		t->index[i] = indexes;
@@ -895,6 +897,7 @@ static int setup_indexes(struct dm_table *t)
 		setup_btree_index(i, t);
 	}
 
+	vfree(indexes_head);
 	return 0;
 }
 
-- 
1.6.3.3


[-- Attachment #3: Type: text/plain, Size: 0 bytes --]

Re: dm: Fixes memory leak in setup_indexes function

[Mike Snitzer]

On Fri, Aug 06 2010 at  5:36am -0400,
Shahzad Hussain Bangash <ext-shahzad.bangash@nokia.com> wrote:

> Sorry for multiple patches. This patch fixes memory leak in
> setup_indexes function where memory is allocated for indexes pointer by
> dm_vcalloc with the size of NODE_size and is not freed after that
> through the end of the function.

There isn't a leak.

The 2nd loop's "t->index[i] = indexes;" takes ownership of the
dm_vcalloc'd memory.  dm_table_destroy() will later free that memory.

Your patch actually introduces a use after free bug.

Regards,
Mike