summaryrefslogtreecommitdiff
path: root/drivers/virtio
diff options
context:
space:
mode:
authorWei Yongjun <weiyj.lk@gmail.com>2016-08-02 17:16:31 +0300
committerMichael S. Tsirkin <mst@redhat.com>2016-08-09 13:42:34 +0300
commit58625edf9e2515ed41dac2a24fa8004030a87b87 (patch)
tree86ca528ccabfdd57a45d70471100ce6d76edf185 /drivers/virtio
parent29b4817d4018df78086157ea3a55c1d9424a7cfc (diff)
downloadlinux-58625edf9e2515ed41dac2a24fa8004030a87b87.tar.xz
virtio: fix memory leak in virtqueue_add()
When using the indirect buffers feature, 'desc' is allocated in virtqueue_add() but isn't freed before leaving on a ring full error, causing a memory leak. For example, it seems rather clear that this can trigger with virtio net if mergeable buffers are not used. Cc: stable@vger.kernel.org Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'drivers/virtio')
-rw-r--r--drivers/virtio/virtio_ring.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 114a0c88afb8..5ed228ddadba 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -327,6 +327,8 @@ static inline int virtqueue_add(struct virtqueue *_vq,
* host should service the ring ASAP. */
if (out_sgs)
vq->notify(&vq->vq);
+ if (indirect)
+ kfree(desc);
END_USE(vq);
return -ENOSPC;
}