[PATCH 1/1] sunrpc: potential memory leak in function rdma_read_xdr

[PATCH 1/1] sunrpc: potential memory leak in function rdma_read_xdr

[Christian Engelmayer]

From: Christian Engelmayer <christian.engelmayer-USXAA5bZaHGDvotElmWtJA@public.gmane.org>

In case the check on ch_count fails the cleanup path is skipped and the
previously allocated memory 'rpl_map', 'chl_map' is not freed.

Signed-off-by: Christian Engelmayer <christian.engelmayer-USXAA5bZaHGDvotElmWtJA@public.gmane.org>
--
Reported by Coverity.

--- linux-2.6.29.4/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c.orig	2009-06-13 23:41:16.000000000 +0200
+++ linux-2.6.29.4/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c	2009-06-13 23:40:21.000000000 +0200
@@ -397,14 +397,14 @@ static int rdma_read_xdr(struct svcxprt_
 	if (!ch)
 		return 0;
 
-	/* Allocate temporary reply and chunk maps */
-	rpl_map = svc_rdma_get_req_map();
-	chl_map = svc_rdma_get_req_map();
-
 	svc_rdma_rcl_chunk_counts(ch, &ch_count, &byte_count);
 	if (ch_count > RPCSVC_MAXPAGES)
 		return -EINVAL;
 
+ 	/* Allocate temporary reply and chunk maps */
+	rpl_map = svc_rdma_get_req_map();
+	chl_map = svc_rdma_get_req_map();
+
 	if (!xprt->sc_frmr_pg_list_len)
 		sge_count = map_read_chunks(xprt, rqstp, hdr_ctxt, rmsgp,
 					    rpl_map, chl_map, ch_count,

Re: [PATCH 1/1] sunrpc: potential memory leak in function rdma_read_xdr

[J. Bruce Fields]

On Sun, Jun 14, 2009 at 12:05:26AM +0200, Christian Engelmayer wrote:
> From: Christian Engelmayer <christian.engelmayer-USXAA5bZaHGDvotElmWtJA@public.gmane.org>
> 
> In case the check on ch_count fails the cleanup path is skipped and the
> previously allocated memory 'rpl_map', 'chl_map' is not freed.
> 
> Signed-off-by: Christian Engelmayer <christian.engelmayer-USXAA5bZaHGDvotElmWtJA@public.gmane.org>
> --
> Reported by Coverity.

Thanks, applied (after fixing up a minor whitespace error--extra space
added before tab on comment line).

rdma_read_xdr() is long.  If there were a logical way to move some of
that into a helper function or two, that might make it easier to read
(and/or might simplify cleanup on failure).

--b.

> 
> --- linux-2.6.29.4/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c.orig	2009-06-13 23:41:16.000000000 +0200
> +++ linux-2.6.29.4/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c	2009-06-13 23:40:21.000000000 +0200
> @@ -397,14 +397,14 @@ static int rdma_read_xdr(struct svcxprt_
>  	if (!ch)
>  		return 0;
>  
> -	/* Allocate temporary reply and chunk maps */
> -	rpl_map = svc_rdma_get_req_map();
> -	chl_map = svc_rdma_get_req_map();
> -
>  	svc_rdma_rcl_chunk_counts(ch, &ch_count, &byte_count);
>  	if (ch_count > RPCSVC_MAXPAGES)
>  		return -EINVAL;
>  
> + 	/* Allocate temporary reply and chunk maps */
> +	rpl_map = svc_rdma_get_req_map();
> +	chl_map = svc_rdma_get_req_map();
> +
>  	if (!xprt->sc_frmr_pg_list_len)
>  		sge_count = map_read_chunks(xprt, rqstp, hdr_ctxt, rmsgp,
>  					    rpl_map, chl_map, ch_count,