Use a variable for return value in batadv_frag_insert_packet() to free the allocated struct batadv_frag_list_entry in all cases where it is not inserted into a chain.
Signed-off-by: Martin Hundebøll martin@hundeboll.net --- fragmentation.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/fragmentation.c b/fragmentation.c index 6054ff6..ab85e75 100644 --- a/fragmentation.c +++ b/fragmentation.c @@ -129,10 +129,11 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, struct hlist_head *chain_out) { struct batadv_frag_table_entry *chain; - struct batadv_frag_list_entry *frag_entry_new, *frag_entry_curr; + struct batadv_frag_list_entry *frag_entry_new = NULL, *frag_entry_curr; struct batadv_frag_packet *frag_packet; uint8_t bucket; uint16_t seqno, hdr_size = sizeof(struct batadv_frag_packet); + bool ret = false;
/* Linearize packet to avoid linearizing 16 packets in a row when doing * the later merge. Non-linear merge should be added to remove this @@ -162,6 +163,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, hlist_add_head(&frag_entry_new->list, &chain->head); chain->size = skb->len - hdr_size; chain->timestamp = jiffies; + ret = true; goto out; }
@@ -177,6 +179,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, &frag_entry_curr->list); chain->size += skb->len - hdr_size; chain->timestamp = jiffies; + ret = true; goto out; } } @@ -186,6 +189,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, hlist_add_after(&frag_entry_curr->list, &frag_entry_new->list); chain->size += skb->len - hdr_size; chain->timestamp = jiffies; + ret = true; }
out: @@ -202,14 +206,14 @@ out: chain->size = 0; }
- spin_unlock_bh(&chain->lock); - return true; - err_unlock: spin_unlock_bh(&chain->lock); - kfree(frag_entry_new); + err: - return false; + if (!ret) + kfree(frag_entry_new); + + return ret; }
/**
On 2013-05-28 08:23, Martin Hundebøll wrote:
Use a variable for return value in batadv_frag_insert_packet() to free the allocated struct batadv_frag_list_entry in all cases where it is not inserted into a chain.
The possible memleak was introduced by 9b3eab61754d74a93c9840c296013fe3b4a1b606 ("batman-adv: Receive fragmented packets and merge")
// Martin
On Tuesday, May 28, 2013 14:37:40 Martin Hundebøll wrote:
On 2013-05-28 08:23, Martin Hundebøll wrote:
Use a variable for return value in batadv_frag_insert_packet() to free the allocated struct batadv_frag_list_entry in all cases where it is not inserted into a chain.
The possible memleak was introduced by 9b3eab61754d74a93c9840c296013fe3b4a1b606 ("batman-adv: Receive fragmented packets and merge")
Applied in revision 0b415bb.
Thanks, Marek
b.a.t.m.a.n@lists.open-mesh.org