diff options
author | Vitaly Kuznetsov <vkuznets@redhat.com> | 2016-05-30 10:17:58 -0400 |
---|---|---|
committer | Bjorn Helgaas <bhelgaas@google.com> | 2016-06-17 13:45:30 -0400 |
commit | 60fcdac8136b4275da42d6edf9ddb10439350289 (patch) | |
tree | f354a033c1e21ce6b6e13e4d24299507a31f51a1 /drivers/pci | |
parent | af8c34ce6ae32addda3788d54a7e340cad22516b (diff) |
PCI: hv: Don't leak buffer in hv_pci_onchannelcallback()
We don't free buffer on several code paths in hv_pci_onchannelcallback(),
put kfree() to the end of the function to fix the issue. Direct { kfree();
return; } can now be replaced with a simple 'break';
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Jake Oshins <jakeo@microsoft.com>
Diffstat (limited to 'drivers/pci')
-rw-r--r-- | drivers/pci/host/pci-hyperv.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c index 7e9b2de2aa24..a68ec4996ed9 100644 --- a/drivers/pci/host/pci-hyperv.c +++ b/drivers/pci/host/pci-hyperv.c | |||
@@ -1661,10 +1661,8 @@ static void hv_pci_onchannelcallback(void *context) | |||
1661 | * All incoming packets must be at least as large as a | 1661 | * All incoming packets must be at least as large as a |
1662 | * response. | 1662 | * response. |
1663 | */ | 1663 | */ |
1664 | if (bytes_recvd <= sizeof(struct pci_response)) { | 1664 | if (bytes_recvd <= sizeof(struct pci_response)) |
1665 | kfree(buffer); | 1665 | break; |
1666 | return; | ||
1667 | } | ||
1668 | desc = (struct vmpacket_descriptor *)buffer; | 1666 | desc = (struct vmpacket_descriptor *)buffer; |
1669 | 1667 | ||
1670 | switch (desc->type) { | 1668 | switch (desc->type) { |
@@ -1679,8 +1677,7 @@ static void hv_pci_onchannelcallback(void *context) | |||
1679 | comp_packet->completion_func(comp_packet->compl_ctxt, | 1677 | comp_packet->completion_func(comp_packet->compl_ctxt, |
1680 | response, | 1678 | response, |
1681 | bytes_recvd); | 1679 | bytes_recvd); |
1682 | kfree(buffer); | 1680 | break; |
1683 | return; | ||
1684 | 1681 | ||
1685 | case VM_PKT_DATA_INBAND: | 1682 | case VM_PKT_DATA_INBAND: |
1686 | 1683 | ||
@@ -1729,6 +1726,8 @@ static void hv_pci_onchannelcallback(void *context) | |||
1729 | } | 1726 | } |
1730 | break; | 1727 | break; |
1731 | } | 1728 | } |
1729 | |||
1730 | kfree(buffer); | ||
1732 | } | 1731 | } |
1733 | 1732 | ||
1734 | /** | 1733 | /** |