Commit 68ed0718 authored by Christophe JAILLET's avatar Christophe JAILLET Committed by Guo Mengqi
Browse files

uio_hv_generic: Fix another memory leak in error handling paths 

mainline inclusion
from mainline-v5.13-rc3
commit 0b0226be
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956G4
CVE: CVE-2021-47070

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0b0226be3a52dadd965644bc52a807961c2c26df



--------------------------------

Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe
function is never freed in the error handling path.

Add the missing 'vmbus_free_ring()' call.

Note that it is already freed in the .remove function.

Fixes: cdfa835c ("uio_hv_generic: defer opening vmbus until first use")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/0d86027b8eeed8e6360bc3d52bcdb328ff9bdca1.1620544055.git.christophe.jaillet@wanadoo.fr


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>

conflicts:
	drivers/uio/uio_hv_generic.c

Signed-off-by: default avatarGuo Mengqi <guomengqi3@huawei.com>
parent a474d353

drivers/uio/uio_hv_generic.c

+3 −1
Original line number Diff line number Diff line
@@ -291,7 +291,7 @@ hv_uio_probe(struct hv_device *dev, 
	pdata->recv_buf = vzalloc(RECV_BUFFER_SIZE);

	if (pdata->recv_buf == NULL) {

		ret = -ENOMEM;

		goto fail_close;

		goto fail_free_ring;

	}



	ret = vmbus_establish_gpadl(channel, pdata->recv_buf,
@@ -351,6 +351,8 @@ hv_uio_probe(struct hv_device *dev, 


fail_close:

	hv_uio_cleanup(dev, pdata);

fail_free_ring:

	vmbus_free_ring(dev->channel);

fail:

	kfree(pdata);