PCI: hv: Don't leak buffer in hv_pci_onchannelcallback()
authorVitaly Kuznetsov <vkuznets@redhat.com>
Mon, 30 May 2016 14:17:58 +0000 (16:17 +0200)
committerBjorn Helgaas <bhelgaas@google.com>
Fri, 17 Jun 2016 17:45:30 +0000 (12:45 -0500)
We don't free buffer on several code paths in hv_pci_onchannelcallback(),
put kfree() to the end of the function to fix the issue.  Direct { kfree();
return; } can now be replaced with a simple 'break';

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Jake Oshins <jakeo@microsoft.com>
drivers/pci/host/pci-hyperv.c

index 7e9b2de2aa24b64306a764d127348db9f91cbe9f..a68ec4996ed9cab6457a52b01c5f3b90028ce2af 100644 (file)
@@ -1661,10 +1661,8 @@ static void hv_pci_onchannelcallback(void *context)
                 * All incoming packets must be at least as large as a
                 * response.
                 */
-               if (bytes_recvd <= sizeof(struct pci_response)) {
-                       kfree(buffer);
-                       return;
-               }
+               if (bytes_recvd <= sizeof(struct pci_response))
+                       break;
                desc = (struct vmpacket_descriptor *)buffer;
 
                switch (desc->type) {
@@ -1679,8 +1677,7 @@ static void hv_pci_onchannelcallback(void *context)
                        comp_packet->completion_func(comp_packet->compl_ctxt,
                                                     response,
                                                     bytes_recvd);
-                       kfree(buffer);
-                       return;
+                       break;
 
                case VM_PKT_DATA_INBAND:
 
@@ -1729,6 +1726,8 @@ static void hv_pci_onchannelcallback(void *context)
                }
                break;
        }
+
+       kfree(buffer);
 }
 
 /**