tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Drivers: hv: Free msginfo when the buffer fails to decrypt

The early failure path in __vmbus_establish_gpadl() doesn't deallocate
msginfo if the buffer fails to decrypt.

Fix the leak by breaking out the cleanup code into a separate function
and calling it where required.

Fixes: d4dccf353db80 ("Drivers: hv: vmbus: Mark vmbus ring buffer visible to host in Isolation VM")
Reported-by: Michael Kelley <mkhlinux@outlook.com>
Closes: https://lore.kernel.org/linux-hyperv/SN6PR02MB41573796F9787F67E0E97049D472A@SN6PR02MB4157.namprd02.prod.outlook.com
Signed-off-by: Roman Kisel <romank@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>

authored by

Roman Kisel and committed by
Wei Liu 51016453 0a4534bd

+18 -6
+18 -6
drivers/hv/channel.c
··· 410 410 return 0; 411 411 } 412 412 413 + static void vmbus_free_channel_msginfo(struct vmbus_channel_msginfo *msginfo) 414 + { 415 + struct vmbus_channel_msginfo *submsginfo, *tmp; 416 + 417 + if (!msginfo) 418 + return; 419 + 420 + list_for_each_entry_safe(submsginfo, tmp, &msginfo->submsglist, 421 + msglistentry) { 422 + kfree(submsginfo); 423 + } 424 + 425 + kfree(msginfo); 426 + } 427 + 413 428 /* 414 429 * __vmbus_establish_gpadl - Establish a GPADL for a buffer or ringbuffer 415 430 * ··· 444 429 struct vmbus_channel_gpadl_header *gpadlmsg; 445 430 struct vmbus_channel_gpadl_body *gpadl_body; 446 431 struct vmbus_channel_msginfo *msginfo = NULL; 447 - struct vmbus_channel_msginfo *submsginfo, *tmp; 432 + struct vmbus_channel_msginfo *submsginfo; 448 433 struct list_head *curr; 449 434 u32 next_gpadl_handle; 450 435 unsigned long flags; ··· 474 459 dev_warn(&channel->device_obj->device, 475 460 "Failed to set host visibility for new GPADL %d.\n", 476 461 ret); 462 + vmbus_free_channel_msginfo(msginfo); 477 463 return ret; 478 464 } 479 465 } ··· 551 535 spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); 552 536 list_del(&msginfo->msglistentry); 553 537 spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); 554 - list_for_each_entry_safe(submsginfo, tmp, &msginfo->submsglist, 555 - msglistentry) { 556 - kfree(submsginfo); 557 - } 558 538 559 - kfree(msginfo); 539 + vmbus_free_channel_msginfo(msginfo); 560 540 561 541 if (ret) { 562 542 /*