Skip to content

Commit

Permalink
PCI: hv: Don't leak buffer in hv_pci_onchannelcallback()
Browse files Browse the repository at this point in the history
We don't free buffer on several code paths in hv_pci_onchannelcallback(),
put kfree() to the end of the function to fix the issue.  Direct { kfree();
return; } can now be replaced with a simple 'break';

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Jake Oshins <jakeo@microsoft.com>
  • Loading branch information
Vitaly Kuznetsov authored and Bjorn Helgaas committed Jun 17, 2016
1 parent af8c34c commit 60fcdac
Showing 1 changed file with 5 additions and 6 deletions.
11 changes: 5 additions & 6 deletions drivers/pci/host/pci-hyperv.c
Original file line number Diff line number Diff line change
Expand Up @@ -1661,10 +1661,8 @@ static void hv_pci_onchannelcallback(void *context)
* All incoming packets must be at least as large as a
* response.
*/
if (bytes_recvd <= sizeof(struct pci_response)) {
kfree(buffer);
return;
}
if (bytes_recvd <= sizeof(struct pci_response))
break;
desc = (struct vmpacket_descriptor *)buffer;

switch (desc->type) {
Expand All @@ -1679,8 +1677,7 @@ static void hv_pci_onchannelcallback(void *context)
comp_packet->completion_func(comp_packet->compl_ctxt,
response,
bytes_recvd);
kfree(buffer);
return;
break;

case VM_PKT_DATA_INBAND:

Expand Down Expand Up @@ -1729,6 +1726,8 @@ static void hv_pci_onchannelcallback(void *context)
}
break;
}

kfree(buffer);
}

/**
Expand Down

0 comments on commit 60fcdac

Please sign in to comment.