svn commit: r336896 - head/sys/dev/xen/blkfront

[Roger Pau Monné]

Author: royger
Date: Mon Jul 30 11:27:51 2018
New Revision: 336896
URL: https://svnweb.freebsd.org/changeset/base/336896

Log:
  xen-blkfront: fix memory leak in xbd_connect error path
  
  If gnttab_grant_foreign_access() fails for any of the indirection
  pages, the code breaks out of both the loops without freeing the local
  variable indirectpages, causing a memory leak.
  
  Submitted by:		Pratyush Yadav <pratyush at freebsd.org>
  Differential Review:	https://reviews.freebsd.org/D16136

Modified:
  head/sys/dev/xen/blkfront/blkfront.c

Modified: head/sys/dev/xen/blkfront/blkfront.c
==============================================================================
--- head/sys/dev/xen/blkfront/blkfront.c	Mon Jul 30 11:15:20 2018	(r336895)
+++ head/sys/dev/xen/blkfront/blkfront.c	Mon Jul 30 11:27:51 2018	(r336896)
@@ -1333,7 +1333,10 @@ xbd_connect(struct xbd_softc *sc)
 		if (sc->xbd_max_request_indirectpages > 0) {
 			indirectpages = contigmalloc(
 			    PAGE_SIZE * sc->xbd_max_request_indirectpages,
-			    M_XENBLOCKFRONT, M_ZERO, 0, ~0, PAGE_SIZE, 0);
+			    M_XENBLOCKFRONT, M_ZERO | M_NOWAIT, 0, ~0,
+			    PAGE_SIZE, 0);
+			if (indirectpages == NULL)
+				sc->xbd_max_request_indirectpages = 0;
 		} else {
 			indirectpages = NULL;
 		}
@@ -1345,8 +1348,12 @@ xbd_connect(struct xbd_softc *sc)
 			    &cm->cm_indirectionrefs[j]))
 				break;
 		}
-		if (j < sc->xbd_max_request_indirectpages)
+		if (j < sc->xbd_max_request_indirectpages) {
+			contigfree(indirectpages,
+			    PAGE_SIZE * sc->xbd_max_request_indirectpages,
+			    M_XENBLOCKFRONT);
 			break;
+		}
 		cm->cm_indirectionpages = indirectpages;
 		xbd_free_command(cm);
 	}