xen/blkback: fix memory leaks (eb535aaf) · Commits · e / devices / android_kernel_fairphone_FP4

[ Upstream commit ae78ca3cf3d9e9f914bfcd0bc5c389ff18b9c2e0 ] In read_per_ring_refs(), after 'req' and related memory regions are allocated, xen_blkif_map() is invoked to map the shared frame, irq, and etc. However, if this mapping process fails, no cleanup is performed, leading to memory leaks. To fix this issue, invoke the cleanup before returning the error. Acked-by:

Roger Pau Monné <roger.pau@citrix.com> Reviewed-by:

Boris Ostrovsky <boris.ostrovsky@oracle.com> Signed-off-by:

Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by:

Jens Axboe <axboe@kernel.dk> Signed-off-by:

Sasha Levin <sashal@kernel.org>

drivers/block/xen-blkback/xenbus.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -974,6 +974,7 @@ static int read_per_ring_refs(struct xen_blkif_ring ring, const char dir)
		}
		blkif->nr_ring_pages = nr_grefs;

		err = -ENOMEM;
		for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
		req = kzalloc(sizeof(*req), GFP_KERNEL);
		if (!req)
		@@ -996,7 +997,7 @@ static int read_per_ring_refs(struct xen_blkif_ring ring, const char dir)
		err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn);
		if (err) {
		xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn);
		return err;
		goto fail;
		}

		return 0;
		@@ -1016,8 +1017,7 @@ static int read_per_ring_refs(struct xen_blkif_ring ring, const char dir)
		}
		kfree(req);
		}
		return -ENOMEM;

		return err;
		}

		static int connect_ring(struct backend_info *be)