Re: [CHECKER] 24 memory leaks on error paths in 2.4.17

[Robert Love <rml@tech9.net>]

[-- Attachment #1: Type: text/plain, Size: 635 bytes --]

On Sun, 2002-06-09 at 20:55, Dawson Engler wrote:
> This checker warns when you do not free allocated memory on failure paths.
> Note: while we only include 24 errors, there were lots in general; let me
> know if more are useful.

Yes they are very useful!  The work you do is amazingly useful and you
have quite a neat tool there ;)

> 1	|	/2.4.17/socket.c
> 
> 	if ((sk=sock->sk) == NULL)
> Error --->
> 		return -EINVAL;

Yep, this is a bug.  It is tricky because in cases where !on, fna does
not need to be freed... so I can see how this was missed.

Marcelo, attached patch, against 2.4.19-pre10, fixes this bug...

	Robert Love


[-- Attachment #2: socket-leak-rml-2.4.19-pre10-1.patch --]
[-- Type: text/x-patch, Size: 422 bytes --]

diff -urN linux-2.4.19-pre10/net/socket.c linux/net/socket.c
--- linux-2.4.19-pre10/net/socket.c	Mon Jun 10 15:26:30 2002
+++ linux/net/socket.c	Mon Jun 10 15:37:48 2002
@@ -743,11 +743,13 @@
 			return -ENOMEM;
 	}
 
-
 	sock = socki_lookup(filp->f_dentry->d_inode);
 	
-	if ((sk=sock->sk) == NULL)
+	if ((sk=sock->sk) == NULL) {
+		if (fna)
+			kfree(fna);
 		return -EINVAL;
+	}
 
 	lock_sock(sk);