diff options
| author | Wei Yongjun <weiyj.lk@gmail.com> | 2016-08-02 17:16:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-09-07 09:32:36 +0300 |
| commit | fa54eea35b3882b18da94d932b78c519c3972bd8 (patch) | |
| tree | fa3527d49004d8195c1e58cbf73ccaa8706c16cc /drivers/virtio/virtio_ring.c | |
| parent | 9dddd02de0366eee747488e8b6829e265b3bf385 (diff) | |
| download | linux-fa54eea35b3882b18da94d932b78c519c3972bd8.tar.xz | |
virtio: fix memory leak in virtqueue_add()
commit 58625edf9e2515ed41dac2a24fa8004030a87b87 upstream.
When using the indirect buffers feature, 'desc' is allocated in
virtqueue_add() but isn't freed before leaving on a ring full error,
causing a memory leak.
For example, it seems rather clear that this can trigger
with virtio net if mergeable buffers are not used.
Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/virtio/virtio_ring.c')
| -rw-r--r-- | drivers/virtio/virtio_ring.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c index ee663c458b20..dc2b94142f53 100644 --- a/drivers/virtio/virtio_ring.c +++ b/drivers/virtio/virtio_ring.c @@ -202,6 +202,8 @@ static inline int virtqueue_add(struct virtqueue *_vq, * host should service the ring ASAP. */ if (out_sgs) vq->notify(&vq->vq); + if (indirect) + kfree(desc); END_USE(vq); return -ENOSPC; } |