[PATCH] Fix memory leak in copy_thread

[PATCH] Fix memory leak in copy_thread

[Andi Kleen]

Discovered on x86-64 and now ported.

copy_thread could leak memory if you had a io bitmap and passed wrong
arguments to the new clone flags.

-Andi

--- linux/arch/i386/kernel/process.c	2003-02-26 12:55:16.000000000 +0100
+++ linux-2.5.63-work/arch/i386/kernel/process.c	2003-03-04 22:28:20.000000000 +0100
@@ -281,6 +281,7 @@
 {
 	struct pt_regs * childregs;
 	struct task_struct *tsk;
+	int err;
 
 	childregs = ((struct pt_regs *) (THREAD_SIZE + (unsigned long) p->thread_info)) - 1;
 	struct_cpy(childregs, regs);
@@ -316,20 +317,27 @@
 		struct user_desc info;
 		int idx;
 
+		err = -EFAULT;
 		if (copy_from_user(&info, (void *)childregs->esi, sizeof(info)))
-			return -EFAULT;
+			goto out;
+		err = -EINVAL;
 		if (LDT_empty(&info))
-			return -EINVAL;
+			goto out;
 
 		idx = info.entry_number;
 		if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
-			return -EINVAL;
+			goto out;
 
 		desc = p->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
 		desc->a = LDT_entry_a(&info);
 		desc->b = LDT_entry_b(&info);
 	}
-	return 0;
+
+	err = 0;
+ out:
+	if (p->thread.ts_io_bitmap)
+		kfree(p->thread.ts_io_bitmap);
+	return err;
 }
 
 /*

Re: [PATCH] Fix memory leak in copy_thread - correction.

[Andi Kleen]

Andi Kleen <ak@muc.de> writes:

> Discovered on x86-64 and now ported.
>
> copy_thread could leak memory if you had a io bitmap and passed wrong
> arguments to the new clone flags.

[...]

Oops that was the wrong buggy version of the patch. Please ignore that
and use this one

-Andi

--- linux/arch/i386/kernel/process.c	2003-02-26 12:55:16.000000000 +0100
+++ linux-2.5.63-work/arch/i386/kernel/process.c	2003-03-04 22:28:20.000000000 +0100
@@ -281,6 +281,7 @@
 {
 	struct pt_regs * childregs;
 	struct task_struct *tsk;
+	int err;
 
 	childregs = ((struct pt_regs *) (THREAD_SIZE + (unsigned long) p->thread_info)) - 1;
 	struct_cpy(childregs, regs);
@@ -316,20 +317,27 @@
 		struct user_desc info;
 		int idx;
 
+		err = -EFAULT;
 		if (copy_from_user(&info, (void *)childregs->esi, sizeof(info)))
-			return -EFAULT;
+			goto out;
+		err = -EINVAL;
 		if (LDT_empty(&info))
-			return -EINVAL;
+			goto out;
 
 		idx = info.entry_number;
 		if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
-			return -EINVAL;
+			goto out;
 
 		desc = p->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
 		desc->a = LDT_entry_a(&info);
 		desc->b = LDT_entry_b(&info);
 	}
-	return 0;
+
+	err = 0;
+ out:
+	if (!err && p->thread.ts_io_bitmap)
+		kfree(p->thread.ts_io_bitmap);
+	return err;
 }
 
 /*