ida: Free allocated bitmap in error path

If a bitmap needs to be allocated, and then by the time the thread
is scheduled to be run again all the indices which would satisfy the
allocation have been allocated then we would leak the allocation.  Almost
impossible to hit in practice, but a trivial fix.  Found by Coverity.

Fixes: f32f004c ("ida: Convert to XArray")
Reported-by: default avatarcoverity-bot <keescook+coverity-bot@chromium.org>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
parent dd841a74
......@@ -470,6 +470,7 @@ int ida_alloc_range(struct ida *ida, unsigned int min, unsigned int max,
goto retry;
nospc:
xas_unlock_irqrestore(&xas, flags);
kfree(alloc);
return -ENOSPC;
}
EXPORT_SYMBOL(ida_alloc_range);
......
......@@ -523,8 +523,27 @@ static void *ida_random_fn(void *arg)
return NULL;
}
static void *ida_leak_fn(void *arg)
{
struct ida *ida = arg;
time_t s = time(NULL);
int i, ret;
rcu_register_thread();
do for (i = 0; i < 1000; i++) {
ret = ida_alloc_range(ida, 128, 128, GFP_KERNEL);
if (ret >= 0)
ida_free(ida, 128);
} while (time(NULL) < s + 2);
rcu_unregister_thread();
return NULL;
}
void ida_thread_tests(void)
{
DEFINE_IDA(ida);
pthread_t threads[20];
int i;
......@@ -536,6 +555,16 @@ void ida_thread_tests(void)
while (i--)
pthread_join(threads[i], NULL);
for (i = 0; i < ARRAY_SIZE(threads); i++)
if (pthread_create(&threads[i], NULL, ida_leak_fn, &ida)) {
perror("creating ida thread");
exit(1);
}
while (i--)
pthread_join(threads[i], NULL);
assert(ida_is_empty(&ida));
}
void ida_tests(void)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment