Commit a219b856 authored by Matthew Wilcox (Oracle)'s avatar Matthew Wilcox (Oracle)
Browse files

ida: Free allocated bitmap in error path



If a bitmap needs to be allocated, and then by the time the thread
is scheduled to be run again all the indices which would satisfy the
allocation have been allocated then we would leak the allocation.  Almost
impossible to hit in practice, but a trivial fix.  Found by Coverity.

Fixes: f32f004c ("ida: Convert to XArray")
Reported-by: default avatarcoverity-bot <keescook+coverity-bot@chromium.org>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
parent dd841a74
Loading
Loading
Loading
Loading
+1 −0
Original line number Diff line number Diff line
@@ -470,6 +470,7 @@ alloc:
	goto retry;
nospc:
	xas_unlock_irqrestore(&xas, flags);
	kfree(alloc);
	return -ENOSPC;
}
EXPORT_SYMBOL(ida_alloc_range);
+29 −0
Original line number Diff line number Diff line
@@ -523,8 +523,27 @@ static void *ida_random_fn(void *arg)
	return NULL;
}

static void *ida_leak_fn(void *arg)
{
	struct ida *ida = arg;
	time_t s = time(NULL);
	int i, ret;

	rcu_register_thread();

	do for (i = 0; i < 1000; i++) {
		ret = ida_alloc_range(ida, 128, 128, GFP_KERNEL);
		if (ret >= 0)
			ida_free(ida, 128);
	} while (time(NULL) < s + 2);

	rcu_unregister_thread();
	return NULL;
}

void ida_thread_tests(void)
{
	DEFINE_IDA(ida);
	pthread_t threads[20];
	int i;

@@ -536,6 +555,16 @@ void ida_thread_tests(void)

	while (i--)
		pthread_join(threads[i], NULL);

	for (i = 0; i < ARRAY_SIZE(threads); i++)
		if (pthread_create(&threads[i], NULL, ida_leak_fn, &ida)) {
			perror("creating ida thread");
			exit(1);
		}

	while (i--)
		pthread_join(threads[i], NULL);
	assert(ida_is_empty(&ida));
}

void ida_tests(void)