From: Ben Widawsky Date: Sun, 21 Feb 2021 03:58:46 +0000 (-0800) Subject: cxl/mem: Fix potential memory leak X-Git-Tag: v5.12-rc1~50^2 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=88ff5d466c0250259818f3153dbdc4af1f8615dd;p=linux-block.git cxl/mem: Fix potential memory leak When submitting a command for userspace, input and output payload bounce buffers are allocated. For a given command, both input and output buffers may exist and so when allocation of the input buffer fails, the output buffer must be freed too. As far as I can tell, userspace can't easily exploit the leak to OOM a machine unless the machine was already near OOM state. Fixes: 583fa5e71cae ("cxl/mem: Add basic IOCTL interface") Reported-by: Konrad Rzeszutek Wilk Signed-off-by: Ben Widawsky Reviewed-by: Jonathan Cameron Reviewed-by: Konrad Rzeszutek Wilk Link: https://lore.kernel.org/r/20210221035846.680145-1-ben.widawsky@intel.com Signed-off-by: Dan Williams --- diff --git a/drivers/cxl/mem.c b/drivers/cxl/mem.c index df895bcca63a..244cb7d89678 100644 --- a/drivers/cxl/mem.c +++ b/drivers/cxl/mem.c @@ -514,8 +514,10 @@ static int handle_mailbox_cmd_from_user(struct cxl_mem *cxlm, if (cmd->info.size_in) { mbox_cmd.payload_in = vmemdup_user(u64_to_user_ptr(in_payload), cmd->info.size_in); - if (IS_ERR(mbox_cmd.payload_in)) + if (IS_ERR(mbox_cmd.payload_in)) { + kvfree(mbox_cmd.payload_out); return PTR_ERR(mbox_cmd.payload_in); + } } rc = cxl_mem_mbox_get(cxlm);