diff mbox

[2/2] 9pfs: fix memory leak about xattr value

Message ID 648301670b2dc88aec68e48abd1bef07c1e201a3.1475990063.git.liqiang6-s@360.cn
State New
Headers show

Commit Message

Li Qiang Oct. 9, 2016, 5:27 a.m. UTC 
From: Li Qiang <liqiang6-s@360.cn>

The 'fs.xattr.value' field in V9fsFidState object doesn't consider
the situation that this field has been allocated previously. Every
time, it will be allocated directly. This leads a  host memory leak
issue. This patch fix this.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
---
 hw/9pfs/9p.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

Greg Kurz Oct. 10, 2016, 9:06 a.m. UTC | #1 
On Sat,  8 Oct 2016 22:27:08 -0700
Li Qiang <liq3ea@gmail.com> wrote:

> From: Li Qiang <liqiang6-s@360.cn>
> 
> The 'fs.xattr.value' field in V9fsFidState object doesn't consider
> the situation that this field has been allocated previously. Every
> time, it will be allocated directly. This leads a  host memory leak
> issue. This patch fix this.
> 

This cannot happen because v9fs_xattrwalk() always allocates this fid:

    xattr_fidp = alloc_fid(s, newfid);
    if (xattr_fidp == NULL) {
        err = -EINVAL;
        goto out;
    }

> Signed-off-by: Li Qiang <liqiang6-s@360.cn>
> ---
>  hw/9pfs/9p.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> index 8751c19..3af23f9 100644
> --- a/hw/9pfs/9p.c
> +++ b/hw/9pfs/9p.c
> @@ -350,6 +350,7 @@ free_out:
>      v9fs_string_free(&fidp->fs.xattr.name);
>  free_value:
>      g_free(fidp->fs.xattr.value);
> +    fidp->fs.xattr.value = NULL;
>      return retval;
>  }
>  
> @@ -3191,7 +3192,8 @@ static void v9fs_xattrwalk(void *opaque)
>          xattr_fidp->fid_type = P9_FID_XATTR;
>          xattr_fidp->fs.xattr.copied_len = -1;
>          if (size) {
> -            xattr_fidp->fs.xattr.value = g_malloc(size);
> +            xattr_fidp->fs.xattr.value = g_realloc(
> +                xattr_fidp->fs.xattr.value, size);
>              err = v9fs_co_llistxattr(pdu, &xattr_fidp->path,
>                                       xattr_fidp->fs.xattr.value,
>                                       xattr_fidp->fs.xattr.len);
> @@ -3224,7 +3226,8 @@ static void v9fs_xattrwalk(void *opaque)
>          xattr_fidp->fid_type = P9_FID_XATTR;
>          xattr_fidp->fs.xattr.copied_len = -1;
>          if (size) {
> -            xattr_fidp->fs.xattr.value = g_malloc(size);
> +            xattr_fidp->fs.xattr.value = g_realloc(
> +                xattr_fidp->fs.xattr.value, size);
>              err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path,
>                                      &name, xattr_fidp->fs.xattr.value,
>                                      xattr_fidp->fs.xattr.len);
Li Qiang Oct. 10, 2016, 9:15 a.m. UTC | #2 
Oops! I have made this patch to dress the memory leak in v9fs_xattrcreate
but forget this and make another mistake.

I mean we should call g_free for xattr.value first in xattr create.

This avoid the memory leak.

static void v9fs_xattrcreate(void *opaque)
{
  ...
    g_free(xattr_fidp->fs.xattr.value);
    xattr_fidp->fs.xattr.value = g_malloc(size);
    err = offset;

}

Should I resend this path series?

2016-10-10 17:06 GMT+08:00 Greg Kurz <groug@kaod.org>:

> On Sat,  8 Oct 2016 22:27:08 -0700
> Li Qiang <liq3ea@gmail.com> wrote:
>
> > From: Li Qiang <liqiang6-s@360.cn>
> >
> > The 'fs.xattr.value' field in V9fsFidState object doesn't consider
> > the situation that this field has been allocated previously. Every
> > time, it will be allocated directly. This leads a  host memory leak
> > issue. This patch fix this.
> >
>
> This cannot happen because v9fs_xattrwalk() always allocates this fid:
>
>     xattr_fidp = alloc_fid(s, newfid);
>     if (xattr_fidp == NULL) {
>         err = -EINVAL;
>         goto out;
>     }
>
> > Signed-off-by: Li Qiang <liqiang6-s@360.cn>
> > ---
> >  hw/9pfs/9p.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> > index 8751c19..3af23f9 100644
> > --- a/hw/9pfs/9p.c
> > +++ b/hw/9pfs/9p.c
> > @@ -350,6 +350,7 @@ free_out:
> >      v9fs_string_free(&fidp->fs.xattr.name);
> >  free_value:
> >      g_free(fidp->fs.xattr.value);
> > +    fidp->fs.xattr.value = NULL;
> >      return retval;
> >  }
> >
> > @@ -3191,7 +3192,8 @@ static void v9fs_xattrwalk(void *opaque)
> >          xattr_fidp->fid_type = P9_FID_XATTR;
> >          xattr_fidp->fs.xattr.copied_len = -1;
> >          if (size) {
> > -            xattr_fidp->fs.xattr.value = g_malloc(size);
> > +            xattr_fidp->fs.xattr.value = g_realloc(
> > +                xattr_fidp->fs.xattr.value, size);
> >              err = v9fs_co_llistxattr(pdu, &xattr_fidp->path,
> >                                       xattr_fidp->fs.xattr.value,
> >                                       xattr_fidp->fs.xattr.len);
> > @@ -3224,7 +3226,8 @@ static void v9fs_xattrwalk(void *opaque)
> >          xattr_fidp->fid_type = P9_FID_XATTR;
> >          xattr_fidp->fs.xattr.copied_len = -1;
> >          if (size) {
> > -            xattr_fidp->fs.xattr.value = g_malloc(size);
> > +            xattr_fidp->fs.xattr.value = g_realloc(
> > +                xattr_fidp->fs.xattr.value, size);
> >              err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path,
> >                                      &name, xattr_fidp->fs.xattr.value,
> >                                      xattr_fidp->fs.xattr.len);
>
>
Greg Kurz Oct. 10, 2016, 10:21 a.m. UTC | #3 
On Mon, 10 Oct 2016 17:15:10 +0800
Li Qiang <liq3ea@gmail.com> wrote:

> Oops! I have made this patch to dress the memory leak in v9fs_xattrcreate

I guess you mean v9fs_xattrwalk().

There is no possible memory leak with v9fs_xattrwalk() because xattr_fidp
comes from alloc_fid(). The leak can only occur when xattr_fidp comes from
get_fid().

> but forget this and make another mistake.
> 
> I mean we should call g_free for xattr.value first in xattr create.
> 
> This avoid the memory leak.
> 
> static void v9fs_xattrcreate(void *opaque)
> {
>   ...
>     g_free(xattr_fidp->fs.xattr.value);
>     xattr_fidp->fs.xattr.value = g_malloc(size);
>     err = offset;
> 
> }
> 

Indeed we have a potential leak with v9fs_xattrcreate().

> Should I resend this path series?
> 

No, you just need to send a patch that fixes the leak in
v9fs_xattrcreate().

> 2016-10-10 17:06 GMT+08:00 Greg Kurz <groug@kaod.org>:
> 
> > On Sat,  8 Oct 2016 22:27:08 -0700
> > Li Qiang <liq3ea@gmail.com> wrote:
> >
> > > From: Li Qiang <liqiang6-s@360.cn>
> > >
> > > The 'fs.xattr.value' field in V9fsFidState object doesn't consider
> > > the situation that this field has been allocated previously. Every
> > > time, it will be allocated directly. This leads a  host memory leak
> > > issue. This patch fix this.
> > >
> >
> > This cannot happen because v9fs_xattrwalk() always allocates this fid:
> >
> >     xattr_fidp = alloc_fid(s, newfid);
> >     if (xattr_fidp == NULL) {
> >         err = -EINVAL;
> >         goto out;
> >     }
> >
> > > Signed-off-by: Li Qiang <liqiang6-s@360.cn>
> > > ---
> > >  hw/9pfs/9p.c | 7 +++++--
> > >  1 file changed, 5 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> > > index 8751c19..3af23f9 100644
> > > --- a/hw/9pfs/9p.c
> > > +++ b/hw/9pfs/9p.c
> > > @@ -350,6 +350,7 @@ free_out:
> > >      v9fs_string_free(&fidp->fs.xattr.name);
> > >  free_value:
> > >      g_free(fidp->fs.xattr.value);
> > > +    fidp->fs.xattr.value = NULL;
> > >      return retval;
> > >  }
> > >
> > > @@ -3191,7 +3192,8 @@ static void v9fs_xattrwalk(void *opaque)
> > >          xattr_fidp->fid_type = P9_FID_XATTR;
> > >          xattr_fidp->fs.xattr.copied_len = -1;
> > >          if (size) {
> > > -            xattr_fidp->fs.xattr.value = g_malloc(size);
> > > +            xattr_fidp->fs.xattr.value = g_realloc(
> > > +                xattr_fidp->fs.xattr.value, size);
> > >              err = v9fs_co_llistxattr(pdu, &xattr_fidp->path,
> > >                                       xattr_fidp->fs.xattr.value,
> > >                                       xattr_fidp->fs.xattr.len);
> > > @@ -3224,7 +3226,8 @@ static void v9fs_xattrwalk(void *opaque)
> > >          xattr_fidp->fid_type = P9_FID_XATTR;
> > >          xattr_fidp->fs.xattr.copied_len = -1;
> > >          if (size) {
> > > -            xattr_fidp->fs.xattr.value = g_malloc(size);
> > > +            xattr_fidp->fs.xattr.value = g_realloc(
> > > +                xattr_fidp->fs.xattr.value, size);
> > >              err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path,
> > >                                      &name, xattr_fidp->fs.xattr.value,
> > >                                      xattr_fidp->fs.xattr.len);
> >
> >
diff mbox

Patch

diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 8751c19..3af23f9 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -350,6 +350,7 @@  free_out:
     v9fs_string_free(&fidp->fs.xattr.name);
 free_value:
     g_free(fidp->fs.xattr.value);
+    fidp->fs.xattr.value = NULL;
     return retval;
 }
 
@@ -3191,7 +3192,8 @@  static void v9fs_xattrwalk(void *opaque)
         xattr_fidp->fid_type = P9_FID_XATTR;
         xattr_fidp->fs.xattr.copied_len = -1;
         if (size) {
-            xattr_fidp->fs.xattr.value = g_malloc(size);
+            xattr_fidp->fs.xattr.value = g_realloc(
+                xattr_fidp->fs.xattr.value, size);
             err = v9fs_co_llistxattr(pdu, &xattr_fidp->path,
                                      xattr_fidp->fs.xattr.value,
                                      xattr_fidp->fs.xattr.len);
@@ -3224,7 +3226,8 @@  static void v9fs_xattrwalk(void *opaque)
         xattr_fidp->fid_type = P9_FID_XATTR;
         xattr_fidp->fs.xattr.copied_len = -1;
         if (size) {
-            xattr_fidp->fs.xattr.value = g_malloc(size);
+            xattr_fidp->fs.xattr.value = g_realloc(
+                xattr_fidp->fs.xattr.value, size);
             err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path,
                                     &name, xattr_fidp->fs.xattr.value,
                                     xattr_fidp->fs.xattr.len);