Commit e0b0cb93 authored Sep 30, 2019 by Navid Emamdoost Committed by Greg Kroah-Hartman Oct 10, 2019

virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr



In hgcm_call_preprocess_linaddr memory is allocated for bounce_buf but
is not released if copy_form_user fails. In order to prevent memory leak
in case of failure, the assignment to bounce_buf_ret is moved before the
error check. This way the allocated bounce_buf will be released by the
caller.

Fixes: 579db9d4 ("virt: Add vboxguest VMMDEV communication code")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20190930204223.3660-1-navid.emamdoost@gmail.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 5dc54a06

drivers/virt/vboxguest/vboxguest_utils.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -220,6 +220,8 @@ static int hgcm_call_preprocess_linaddr(
		if (!bounce_buf)
		return -ENOMEM;

		*bounce_buf_ret = bounce_buf;

		if (copy_in) {
		ret = copy_from_user(bounce_buf, (void __user *)buf, len);
		if (ret)
		@@ -228,7 +230,6 @@ static int hgcm_call_preprocess_linaddr(
		memset(bounce_buf, 0, len);
		}

		*bounce_buf_ret = bounce_buf;
		hgcm_call_add_pagelist_size(bounce_buf, len, extra);
		return 0;
		}