[PATCH 3/3] fsstress: fix memory leak in do_aio_rw

Zorro Lang
2020-07-15T16:08:53Z

If io_submit or io_getevents fails, the do_aio_rw() won't free the
"buf" and cause memory leak.

Signed-off-by: Zorro Lang <zlang@redhat.com>
---
ltp/fsstress.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/ltp/fsstress.c b/ltp/fsstress.c
index a11206d4..410a2437 100644
--- a/ltp/fsstress.c
+++ b/ltp/fsstress.c
@@ -2099,8 +2099,7 @@ do_aio_rw(int opno, long r, int flags)
if (!get_fname(FT_REGFILE, r, &f, NULL, NULL, &v)) {
if (v)
printf("%d/%d: do_aio_rw - no filename\n", procid, opno);
- free_pathname(&f);
- return;
+ goto aio_out3;
}
fd = open_path(&f, flags|O_DIRECT);
e = fd < 0 ? errno : 0;
@@ -2109,16 +2108,13 @@ do_aio_rw(int opno, long r, int flags)
if (v)
printf("%d/%d: do_aio_rw - open %s failed %d\n",
procid, opno, f.path, e);
- free_pathname(&f);
- return;
+ goto aio_out3;
}
if (fstat64(fd, &stb) < 0) {
if (v)
printf("%d/%d: do_aio_rw - fstat64 %s failed %d\n",
procid, opno, f.path, errno);
- free_pathname(&f);
- close(fd);
- return;
+ goto aio_out2;
}
inode_info(st, sizeof(st), &stb, v);
if (!iswrite && stb.st_size == 0) {
@@ -2150,6 +2146,12 @@ do_aio_rw(int opno, long r, int flags)
else if (len > diob.d_maxiosz)
len = diob.d_maxiosz;
buf = memalign(diob.d_mem, len);
+ if (!buf) {
+ if (v)
+ printf("%d/%d: do_aio_rw - memalign failed\n",
+ procid, opno);
+ goto aio_out2;
+ }

if (iswrite) {
off = (off64_t)(lr % MIN(stb.st_size + (1024 * 1024), MAXFSIZE));
@@ -2166,27 +2168,26 @@ do_aio_rw(int opno, long r, int flags)
if (v)
printf("%d/%d: %s - io_submit failed %d\n",
procid, opno, iswrite ? "awrite" : "aread", e);
- free_pathname(&f);
- close(fd);
- return;
+ goto aio_out1;
}
if ((e = io_getevents(io_ctx, 1, 1, &event, NULL)) != 1) {
if (v)
printf("%d/%d: %s - io_getevents failed %d\n",
procid, opno, iswrite ? "awrite" : "aread", e);
- free_pathname(&f);
- close(fd);
- return;
+ goto aio_out1;
}

e = event.res != len ? event.res2 : 0;
- free(buf);
if (v)
printf("%d/%d: %s %s%s [%lld,%d] %d\n",
procid, opno, iswrite ? "awrite" : "aread",
f.path, st, (long long)off, (int)len, e);
- free_pathname(&f);
+ aio_out1:
+ free(buf);
+ aio_out2:
close(fd);
+ aio_out3:
+ free_pathname(&f);
}
#endif

--
2.20.1