Commit 7590ebb8 authored by Yi Wang's avatar Yi Wang Committed by Zhenyu Wang

drm/i915/gvt: fix memory leak in intel_vgpu_ioctl()

The 'sparse' variable may leak when return in function
intel_vgpu_ioctl(), and this patch fix this.
Signed-off-by: default avatarYi Wang <wang.yi59@zte.com.cn>
Reviewed-by: default avatarJiang Biao <jiang.biao2@zte.com.cn>
Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
parent 4b25e737
...@@ -1257,11 +1257,13 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd, ...@@ -1257,11 +1257,13 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
&sparse->header, sizeof(*sparse) + &sparse->header, sizeof(*sparse) +
(sparse->nr_areas * (sparse->nr_areas *
sizeof(*sparse->areas))); sizeof(*sparse->areas)));
if (ret) {
kfree(sparse); kfree(sparse);
if (ret)
return ret; return ret;
}
break; break;
default: default:
kfree(sparse);
return -EINVAL; return -EINVAL;
} }
} }
...@@ -1277,6 +1279,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd, ...@@ -1277,6 +1279,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
sizeof(info), caps.buf, sizeof(info), caps.buf,
caps.size)) { caps.size)) {
kfree(caps.buf); kfree(caps.buf);
kfree(sparse);
return -EFAULT; return -EFAULT;
} }
info.cap_offset = sizeof(info); info.cap_offset = sizeof(info);
...@@ -1285,6 +1288,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd, ...@@ -1285,6 +1288,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
kfree(caps.buf); kfree(caps.buf);
} }
kfree(sparse);
return copy_to_user((void __user *)arg, &info, minsz) ? return copy_to_user((void __user *)arg, &info, minsz) ?
-EFAULT : 0; -EFAULT : 0;
} else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) { } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment