[U-Boot] [PATCH v2 1/4] disk: efi: Fix memory leak on 'gpt guid'

[Lukasz Majewski <lukma@denx.de>]

On Thu, 2 May 2019 14:27:03 +0200
Eugeniu Rosca <erosca@de.adit-jv.com> wrote:

> Below is what happens on R-Car H3ULCB-KF using clean U-Boot
> v2019.04-00810-g6aebc0d11a10 and r8a7795_ulcb_defconfig:
> 
>  => ### interrupt autoboot
>  => gpt guid mmc 1  
>  21200400-0804-0146-9dcc-a8c51255994f
>  success!
>  => ### keep calling 'gpt guid mmc 1'
>  => ### on 59th call, we are out of memory:
>  => gpt guid mmc 1  
>  alloc_read_gpt_entries: ERROR: Can't allocate 0X4000 bytes for GPT
> Entries GPT: Failed to allocate memory for PTE
>  get_disk_guid: *** ERROR: Invalid GPT ***
>  alloc_read_gpt_entries: ERROR: Can't allocate 0X4000 bytes for GPT
> Entries GPT: Failed to allocate memory for PTE
>  get_disk_guid: *** ERROR: Invalid Backup GPT ***
>  error!
> 
> After some inspection, it looks like get_disk_guid(), added via
> v2017.09 commit 73d6d18b7147c9 ("GPT: add accessor function for disk
> GUID"), unlike other callers of is_gpt_valid(), doesn't free the
> memory pointed out by 'gpt_entry *gpt_pte'. The latter is allocated
> by is_gpt_valid() via alloc_read_gpt_entries().
> 
> With the fix applied, the reproduction scenario has been run hundreds
> of times ('while true; do gpt guid mmc 1; done') w/o running into OOM.
> 
> Fixes: 73d6d18b7147c9 ("GPT: add accessor function for disk GUID")
> Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> --
> v2:
>  - Added Reviewed-by: Heinrich Schuchardt
> v1:
>  - https://patchwork.ozlabs.org/patch/1092942/
> ---
>  disk/part_efi.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/disk/part_efi.c b/disk/part_efi.c
> index 239455b8161e..812d14cdd871 100644
> --- a/disk/part_efi.c
> +++ b/disk/part_efi.c
> @@ -209,6 +209,8 @@ int get_disk_guid(struct blk_desc * dev_desc,
> char *guid) guid_bin = gpt_head->disk_guid.b;
>  	uuid_bin_to_str(guid_bin, guid, UUID_STR_FORMAT_GUID);
>  
> +	/* Remember to free pte */
> +	free(gpt_pte);
>  	return 0;
>  }
>  

Reviewed-by: Lukasz Majewski <lukma@denx.de>


Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lukma at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20190507/efdd53a4/attachment.sig>