[PATCH iproute2 0/2] fix two memory leaks

[PATCH iproute2 0/2] fix two memory leaks

[Andrea Claudi]

This series fixes two memory leaks in iproute2,
in tc and devlink code.

Andrea Claudi (2):
  devlink: fix memory leak in cmd_dev_flash()
  tc: pedit: fix memory leak in print_pedit

 devlink/devlink.c | 13 ++++++++-----
 tc/m_pedit.c      |  4 +++-
 2 files changed, 11 insertions(+), 6 deletions(-)

-- 
2.29.2

[PATCH iproute2 1/2] devlink: fix memory leak in cmd_dev_flash()

[Andrea Claudi]

nlg_ntf is dinamically allocated in mnlg_socket_open(), and is freed on
the out: return path. However, some error paths do not free it,
resulting in memory leak.

This commit fix this using mnlg_socket_close(), and reporting the
correct error number when required.

Fixes: 9b13cddfe268 ("devlink: implement flash status monitoring")
Signed-off-by: Andrea Claudi <aclaudi@redhat.com>
---
 devlink/devlink.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/devlink/devlink.c b/devlink/devlink.c
index ca99732e..43549965 100644
--- a/devlink/devlink.c
+++ b/devlink/devlink.c
@@ -3371,19 +3371,21 @@ static int cmd_dev_flash(struct dl *dl)
 
 	err = _mnlg_socket_group_add(nlg_ntf, DEVLINK_GENL_MCGRP_CONFIG_NAME);
 	if (err)
-		return err;
+		goto err_socket;
 
 	err = pipe(pipe_fds);
-	if (err == -1)
-		return -errno;
+	if (err == -1) {
+		err = -errno;
+		goto err_socket;
+	}
 	pipe_r = pipe_fds[0];
 	pipe_w = pipe_fds[1];
 
 	pid = fork();
 	if (pid == -1) {
-		close(pipe_r);
 		close(pipe_w);
-		return -errno;
+		err = -errno;
+		goto out;
 	} else if (!pid) {
 		/* In child, just execute the flash and pass returned
 		 * value through pipe once it is done.
@@ -3412,6 +3414,7 @@ static int cmd_dev_flash(struct dl *dl)
 	err = _mnlg_socket_recv_run(dl->nlg, NULL, NULL);
 out:
 	close(pipe_r);
+err_socket:
 	mnlg_socket_close(nlg_ntf);
 	return err;
 }
-- 
2.29.2

[PATCH iproute2 2/2] tc: pedit: fix memory leak in print_pedit

[Andrea Claudi]

keys_ex is dinamically allocated with calloc on line 770, but
is not freed in case of error at line 823.

Fixes: 081d6c310d3a ("tc: pedit: Support JSON dumping")
Signed-off-by: Andrea Claudi <aclaudi@redhat.com>
---
 tc/m_pedit.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tc/m_pedit.c b/tc/m_pedit.c
index 51dcf109..aa874408 100644
--- a/tc/m_pedit.c
+++ b/tc/m_pedit.c
@@ -819,8 +819,10 @@ static int print_pedit(struct action_util *au, FILE *f, struct rtattr *arg)
 			print_uint(PRINT_FP, NULL, "\n\t key #%d  at ", i);
 
 			err = print_pedit_location(f, htype, key->off);
-			if (err)
+			if (err) {
+				free(keys_ex);
 				return err;
+			}
 
 			/* In FP, report the "set" command as "val" to keep
 			 * backward compatibility. Report the true name in JSON.
-- 
2.29.2