diff options
| author | Vitaly Kuznetsov <vkuznets@redhat.com> | 2016-05-30 17:17:58 +0300 |
|---|---|---|
| committer | Bjorn Helgaas <bhelgaas@google.com> | 2016-06-17 20:45:30 +0300 |
| commit | 60fcdac8136b4275da42d6edf9ddb10439350289 (patch) | |
| tree | f354a033c1e21ce6b6e13e4d24299507a31f51a1 /drivers/pci/host/pci-hyperv.c | |
| parent | af8c34ce6ae32addda3788d54a7e340cad22516b (diff) | |
| download | linux-60fcdac8136b4275da42d6edf9ddb10439350289.tar.xz | |
PCI: hv: Don't leak buffer in hv_pci_onchannelcallback()
We don't free buffer on several code paths in hv_pci_onchannelcallback(),
put kfree() to the end of the function to fix the issue. Direct { kfree();
return; } can now be replaced with a simple 'break';
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Jake Oshins <jakeo@microsoft.com>
Diffstat (limited to 'drivers/pci/host/pci-hyperv.c')
| -rw-r--r-- | drivers/pci/host/pci-hyperv.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c index 7e9b2de2aa24..a68ec4996ed9 100644 --- a/drivers/pci/host/pci-hyperv.c +++ b/drivers/pci/host/pci-hyperv.c @@ -1661,10 +1661,8 @@ static void hv_pci_onchannelcallback(void *context) * All incoming packets must be at least as large as a * response. */ - if (bytes_recvd <= sizeof(struct pci_response)) { - kfree(buffer); - return; - } + if (bytes_recvd <= sizeof(struct pci_response)) + break; desc = (struct vmpacket_descriptor *)buffer; switch (desc->type) { @@ -1679,8 +1677,7 @@ static void hv_pci_onchannelcallback(void *context) comp_packet->completion_func(comp_packet->compl_ctxt, response, bytes_recvd); - kfree(buffer); - return; + break; case VM_PKT_DATA_INBAND: @@ -1729,6 +1726,8 @@ static void hv_pci_onchannelcallback(void *context) } break; } + + kfree(buffer); } /** |