virtio: fix memory leak in virtqueue_add()
authorWei Yongjun <weiyj.lk@gmail.com>
Tue, 2 Aug 2016 14:16:31 +0000 (14:16 +0000)
committerMichael S. Tsirkin <mst@redhat.com>
Tue, 9 Aug 2016 10:42:34 +0000 (13:42 +0300)
When using the indirect buffers feature, 'desc' is allocated in
virtqueue_add() but isn't freed before leaving on a ring full error,
causing a memory leak.

For example, it seems rather clear that this can trigger
with virtio net if mergeable buffers are not used.

Cc: stable@vger.kernel.org
Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
drivers/virtio/virtio_ring.c

index 114a0c88afb8bfad71dc7b4612ccf9ed66f59d54..5ed228ddadba0863b60214cfa8d1b57a0cfb47ab 100644 (file)
@@ -327,6 +327,8 @@ static inline int virtqueue_add(struct virtqueue *_vq,
                 * host should service the ring ASAP. */
                if (out_sgs)
                        vq->notify(&vq->vq);
+               if (indirect)
+                       kfree(desc);
                END_USE(vq);
                return -ENOSPC;
        }