From: Wei Yongjun <weiyj.lk@gmail.com>
Date: Tue, 2 Aug 2016 14:16:31 +0000 (+0000)
Subject: virtio: fix memory leak in virtqueue_add()
X-Git-Tag: v4.1.12-111.0.20170918_2215~155
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=815295d16bc43b423f6fd83419a3af79e2562ac6;p=users%2Fjedix%2Flinux-maple.git

virtio: fix memory leak in virtqueue_add()

Orabug: 26813294

When using the indirect buffers feature, 'desc' is allocated in
virtqueue_add() but isn't freed before leaving on a ring full error,
causing a memory leak.

For example, it seems rather clear that this can trigger
with virtio net if mergeable buffers are not used.

Cc: stable@vger.kernel.org
Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 58625edf9e2515ed41dac2a24fa8004030a87b87)
Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
---

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 096b857e7b75..94b11d96c8fa 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -196,6 +196,8 @@ static inline int virtqueue_add(struct virtqueue *_vq,
 		 * host should service the ring ASAP. */
 		if (out_sgs)
 			vq->notify(&vq->vq);
+		if (indirect)
+			kfree(desc);
 		END_USE(vq);
 		return -ENOSPC;
 	}