diff options
author | J. Bruce Fields <bfields@snoopy.citi.umich.edu> | 2007-02-16 04:28:30 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-02-16 11:14:01 -0500 |
commit | a4db5fe5dfb3a5b5b550f1acd95ef3de01a3f063 (patch) | |
tree | 38d4ebad2877789d481185c973dbba449cbaee61 /fs/nfsd/nfs4xdr.c | |
parent | 28e05dd8457c7a7fa1c3faac169a95e0ce4b4a12 (diff) |
[PATCH] knfsd: nfsd4: fix memory leak on kmalloc failure in savemem
The wrong pointer is being kfree'd in savemem() when defer_free returns with
an error.
Signed-off-by: Benny Halevy <bhalevy@panasas.com>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/nfsd/nfs4xdr.c')
-rw-r--r-- | fs/nfsd/nfs4xdr.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index fbb4af969243..bb0f1860f582 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c | |||
@@ -199,24 +199,22 @@ defer_free(struct nfsd4_compoundargs *argp, | |||
199 | 199 | ||
200 | static char *savemem(struct nfsd4_compoundargs *argp, __be32 *p, int nbytes) | 200 | static char *savemem(struct nfsd4_compoundargs *argp, __be32 *p, int nbytes) |
201 | { | 201 | { |
202 | void *new = NULL; | ||
203 | if (p == argp->tmp) { | 202 | if (p == argp->tmp) { |
204 | new = kmalloc(nbytes, GFP_KERNEL); | 203 | p = kmalloc(nbytes, GFP_KERNEL); |
205 | if (!new) return NULL; | 204 | if (!p) |
206 | p = new; | 205 | return NULL; |
207 | memcpy(p, argp->tmp, nbytes); | 206 | memcpy(p, argp->tmp, nbytes); |
208 | } else { | 207 | } else { |
209 | BUG_ON(p != argp->tmpp); | 208 | BUG_ON(p != argp->tmpp); |
210 | argp->tmpp = NULL; | 209 | argp->tmpp = NULL; |
211 | } | 210 | } |
212 | if (defer_free(argp, kfree, p)) { | 211 | if (defer_free(argp, kfree, p)) { |
213 | kfree(new); | 212 | kfree(p); |
214 | return NULL; | 213 | return NULL; |
215 | } else | 214 | } else |
216 | return (char *)p; | 215 | return (char *)p; |
217 | } | 216 | } |
218 | 217 | ||
219 | |||
220 | static __be32 | 218 | static __be32 |
221 | nfsd4_decode_bitmap(struct nfsd4_compoundargs *argp, u32 *bmval) | 219 | nfsd4_decode_bitmap(struct nfsd4_compoundargs *argp, u32 *bmval) |
222 | { | 220 | { |