From nobody Tue Apr 30 15:06:43 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1586441767; cv=none; d=zohomail.com; s=zohoarc; b=Tu7/zav6FcWk2B1gOTAfJ1zhmt+56LdAsPDrFugyn40BpDYLx2LaDiQgILF4kNWE7dHD8CA4I608K03jG3H75RmLdbwUwycqtoEfotQDl15JdbnB1GguywZrO+tG/aoEGMIyhEn4Yr0umbmfDWM1Yqy1OZhOnsKBt9WvYXOkRHw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1586441767; h=Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:To; bh=iVR+Iq+GfqWh1TEmEOhKSnVCaGz6FBy3UY7jDcO8MZs=; b=RJSkBAVnqRRLKa6Pl1PJWwT93+9clPP2pHc9Ui7RHY+Z5tqyiwQGrHCzT+bxtYlo1ZHHRCTu1Ab/VAAMeuuQRZTSyftFzz3gs50b2InjvTfa+ZzrvFm7dOhvruxo8SaGra8XYLHUNnsGXhAX78PTXQ8Ya2pcf2rwebZtmhfQyzk= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1586441767360409.3444046702069; Thu, 9 Apr 2020 07:16:07 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jMXvK-0002oV-Ca; Thu, 09 Apr 2020 14:12:54 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jMXvI-0002oI-RA for xen-devel@lists.xenproject.org; Thu, 09 Apr 2020 14:12:52 +0000 Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 2efc5962-7a6c-11ea-82d6-12813bfff9fa; Thu, 09 Apr 2020 14:12:45 +0000 (UTC) Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id E6972AD72; Thu, 9 Apr 2020 14:12:43 +0000 (UTC) X-Inumbo-ID: 2efc5962-7a6c-11ea-82d6-12813bfff9fa X-Virus-Scanned: by amavisd-new at test-mx.suse.de From: Juergen Gross To: minios-devel@lists.xenproject.org, xen-devel@lists.xenproject.org Subject: [PATCH 1/3] mini-os: fix double free() in netfront Date: Thu, 9 Apr 2020 16:12:38 +0200 Message-Id: <20200409141240.28876-2-jgross@suse.com> X-Mailer: git-send-email 2.16.4 In-Reply-To: <20200409141240.28876-1-jgross@suse.com> References: <20200409141240.28876-1-jgross@suse.com> X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Juergen Gross , samuel.thibault@ens-lyon.org, wl@xen.org Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Commit d225f4012d69a19 ("Save/Restore Support: Add suspend/restore support for netfront") introduced a regression in form of freeing a netfront device structure twice. Fix that. Coverity-ID: 1433637 Fixes: d225f4012d69a19 ("Save/Restore Support: Add suspend/restore support = for netfront") Signed-off-by: Juergen Gross Acked-by: Wei Liu Reviewed-by: Samuel Thibault --- netfront.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/netfront.c b/netfront.c index 50b3a57..fe7bb62 100644 --- a/netfront.c +++ b/netfront.c @@ -584,8 +584,6 @@ void shutdown_netfront(struct netfront_dev *dev) list->refcount--; if (list->refcount =3D=3D 0) { _shutdown_netfront(dev); - free(dev->nodename); - free(dev); =20 to_del =3D list; if (to_del =3D=3D dev_list) { --=20 2.16.4 From nobody Tue Apr 30 15:06:43 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1586441637; cv=none; d=zohomail.com; s=zohoarc; b=YAIpfXwGIQEde86v6LQIc/ZLGFt/Ba1nmn1/ONYarFIeZVqd+5v+Dgwq73G8GUpDTnDq7rQHXeICqFbliQkU04DsggGfNrzGZPwgsHhxKvnfX827i1j+YBc1ZSgPlQRbcaHw91rd+Wpyi5uJ6zwNPaVAEOKF7UnlNf+wSXJmv5g= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1586441637; h=Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:To; bh=AmwueCeHVHvBgDophbhj/5mqT4X7ebmqwWJmR1el6E8=; b=CE1FbSEqQVx385//D9kO35xyNlkhnIl/zdU2oanq6d2jaEJfMBta1X1IBV+9QDtGAF7VZ1iChTD147xYJNe+8v+mw+Wqj9z1tsc0ZleXJ1MVeeMYg202+EqkohU/JqwcXC0Gbj11i/WXy6yckI32P4kMtgBOp9dNOMIsD/rdbC8= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 158644163725973.4449142800164; Thu, 9 Apr 2020 07:13:57 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jMXvF-0002nv-2C; Thu, 09 Apr 2020 14:12:49 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jMXvD-0002nk-T3 for xen-devel@lists.xenproject.org; Thu, 09 Apr 2020 14:12:47 +0000 Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 2f0d72f6-7a6c-11ea-82d6-12813bfff9fa; Thu, 09 Apr 2020 14:12:46 +0000 (UTC) Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 0607EAE59; Thu, 9 Apr 2020 14:12:43 +0000 (UTC) X-Inumbo-ID: 2f0d72f6-7a6c-11ea-82d6-12813bfff9fa X-Virus-Scanned: by amavisd-new at test-mx.suse.de From: Juergen Gross To: minios-devel@lists.xenproject.org, xen-devel@lists.xenproject.org Subject: [PATCH 2/3] mini-os: fix double free() in xenbus Date: Thu, 9 Apr 2020 16:12:39 +0200 Message-Id: <20200409141240.28876-3-jgross@suse.com> X-Mailer: git-send-email 2.16.4 In-Reply-To: <20200409141240.28876-1-jgross@suse.com> References: <20200409141240.28876-1-jgross@suse.com> X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Juergen Gross , samuel.thibault@ens-lyon.org, wl@xen.org Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Commit 973ad0c4de1b48 ("Save/Restore Support: Add suspend/restore support for xenbus") introduced a double free of some memory and leaked another memory allocation. Fix those. Coverity-ID: 1433640 Fixes: 973ad0c4de1b48 ("Save/Restore Support: Add suspend/restore support f= or xenbus") Signed-off-by: Juergen Gross Acked-by: Wei Liu Reviewed-by: Samuel Thibault --- xenbus/xenbus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/xenbus/xenbus.c b/xenbus/xenbus.c index d72dc3a..b12cef7 100644 --- a/xenbus/xenbus.c +++ b/xenbus/xenbus.c @@ -413,9 +413,11 @@ void resume_xenbus(int canceled) =20 rep =3D xenbus_msg_reply(XS_WATCH, XBT_NIL, req, ARRAY_SIZE(re= q)); msg =3D errmsg(rep); - if (msg) + if (msg) { xprintk("error on XS_WATCH: %s\n", msg); - free(rep); + free(msg); + } else + free(rep); } } =20 --=20 2.16.4 From nobody Tue Apr 30 15:06:43 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1586441602; cv=none; d=zohomail.com; s=zohoarc; b=hGSJWD1ImPlkc/6xbtaliQc/vQoJIseD135iBrOtt9kiqV08Nt2c0zkBz41EzR5K90RYGlexEIukP2n9AM/H5Gs2kVmBNPbNLm9mWWI1AZ7ZYKxKpDtlV9/ZqjDJjBnk7iRLS2HxWjedLoDxzWfwEQyZM2lZ2O8ary32dw+rLHY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1586441602; h=Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:To; bh=lrPD0QKPt5a63G6AfJQ8pv3Gl7C13/VWYLF/OjvRpWw=; b=nfp9VHntxwyshtUL6u7JboepyKDQ1tQY4u/UyPLR5oDjnyrDMqUDJK3+H2UmglffiGN5gZyFJ5tq+Pa+BD+y6D/k9XJuMc6V/iKSX4hVG6nwXva0HkqxGm+FS8IoUZiEgFdISLuyFQbPJb9MYIm2toPMBB1fDWvsgkiggkRgeC0= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1586441602512569.0989424278152; Thu, 9 Apr 2020 07:13:22 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jMXvR-0002sl-TY; Thu, 09 Apr 2020 14:13:01 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jMXvR-0002sX-HH for xen-devel@lists.xenproject.org; Thu, 09 Apr 2020 14:13:01 +0000 Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 2f29d108-7a6c-11ea-b4f4-bc764e2007e4; Thu, 09 Apr 2020 14:12:46 +0000 (UTC) Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 2EF93AF6E; Thu, 9 Apr 2020 14:12:44 +0000 (UTC) X-Inumbo-ID: 2f29d108-7a6c-11ea-b4f4-bc764e2007e4 X-Virus-Scanned: by amavisd-new at test-mx.suse.de From: Juergen Gross To: minios-devel@lists.xenproject.org, xen-devel@lists.xenproject.org Subject: [PATCH 3/3] mini-os: fix several memory leaks related to xenbus Date: Thu, 9 Apr 2020 16:12:40 +0200 Message-Id: <20200409141240.28876-4-jgross@suse.com> X-Mailer: git-send-email 2.16.4 In-Reply-To: <20200409141240.28876-1-jgross@suse.com> References: <20200409141240.28876-1-jgross@suse.com> X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Juergen Gross , samuel.thibault@ens-lyon.org, wl@xen.org Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" There are several instances of calls to xenbus functions which don't test for an error and in consequence are not freeing the returned error strings, or which are just not freeing the string after e.g. printing it. Fix that by either adding the needed calls of free(). Coverity-ID: 1433632 Signed-off-by: Juergen Gross Acked-by: Wei Liu Reviewed-by: Samuel Thibault --- blkfront.c | 4 ++-- console/xenbus.c | 2 +- fbfront.c | 4 ++-- netfront.c | 2 +- pcifront.c | 28 +++++++++++++--------------- shutdown.c | 2 +- xenbus/xenbus.c | 2 ++ 7 files changed, 22 insertions(+), 22 deletions(-) diff --git a/blkfront.c b/blkfront.c index f747216..834a978 100644 --- a/blkfront.c +++ b/blkfront.c @@ -200,7 +200,7 @@ done: =20 snprintf(path, sizeof(path), "%s/state", dev->backend); =20 - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); =20 msg =3D NULL; state =3D xenbus_read_integer(path); @@ -208,7 +208,7 @@ done: msg =3D xenbus_wait_for_state_change(path, &state, &dev->event= s); if (msg !=3D NULL || state !=3D XenbusStateConnected) { printk("backend not available, state=3D%d\n", state); - xenbus_unwatch_path_token(XBT_NIL, path, path); + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); goto error; } =20 diff --git a/console/xenbus.c b/console/xenbus.c index 654b469..05fc31c 100644 --- a/console/xenbus.c +++ b/console/xenbus.c @@ -164,7 +164,7 @@ done: char path[strlen(dev->backend) + strlen("/state") + 1]; snprintf(path, sizeof(path), "%s/state", dev->backend); =20 - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); msg =3D NULL; state =3D xenbus_read_integer(path); while (msg =3D=3D NULL && state < XenbusStateConnected) diff --git a/fbfront.c b/fbfront.c index 9cc07b4..d3b3848 100644 --- a/fbfront.c +++ b/fbfront.c @@ -163,7 +163,7 @@ done: =20 snprintf(path, sizeof(path), "%s/state", dev->backend); =20 - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); =20 err =3D NULL; state =3D xenbus_read_integer(path); @@ -530,7 +530,7 @@ done: =20 snprintf(path, sizeof(path), "%s/state", dev->backend); =20 - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); =20 err =3D NULL; state =3D xenbus_read_integer(path); diff --git a/netfront.c b/netfront.c index fe7bb62..66f2bbc 100644 --- a/netfront.c +++ b/netfront.c @@ -513,7 +513,7 @@ done: err =3D xenbus_wait_for_state_change(path, &state, &dev->event= s); if (state !=3D XenbusStateConnected) { printk("backend not avalable, state=3D%d\n", state); - xenbus_unwatch_path_token(XBT_NIL, path, path); + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); goto error; } =20 diff --git a/pcifront.c b/pcifront.c index 0fc5b30..5642356 100644 --- a/pcifront.c +++ b/pcifront.c @@ -70,28 +70,28 @@ void pcifront_watches(void *opaque) =20 while (1) { printk("pcifront_watches: waiting for backend path to appear %s\n"= , path); - xenbus_watch_path_token(XBT_NIL, path, path, &events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &events)); while ((err =3D xenbus_read(XBT_NIL, path, &be_path)) !=3D NULL) { free(err); xenbus_wait_for_watch(&events); } - xenbus_unwatch_path_token(XBT_NIL, path, path); + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); printk("pcifront_watches: waiting for backend to get into the righ= t state %s\n", be_path); be_state =3D (char *) malloc(strlen(be_path) + 7); snprintf(be_state, strlen(be_path) + 7, "%s/state", be_path); - xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events); + free(xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events)= ); while ((err =3D xenbus_read(XBT_NIL, be_state, &msg)) !=3D NULL ||= msg[0] > '4') { free(msg); free(err); xenbus_wait_for_watch(&events); } - xenbus_unwatch_path_token(XBT_NIL, be_state, be_state); + free(xenbus_unwatch_path_token(XBT_NIL, be_state, be_state)); if (init_pcifront(NULL) =3D=3D NULL) { free(be_state); free(be_path); continue; } - xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events); + free(xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events)= ); state =3D XenbusStateConnected; printk("pcifront_watches: waiting for backend events %s\n", be_sta= te); while ((err =3D xenbus_wait_for_state_change(be_state, &state, &ev= ents)) =3D=3D NULL && @@ -103,10 +103,9 @@ void pcifront_watches(void *opaque) if ((err =3D xenbus_switch_state(XBT_NIL, fe_state, Xenbus= StateReconfiguring)) !=3D NULL) { printk("pcifront_watches: error changing state to %d: = %s\n", XenbusStateReconfiguring, err); - if (!strcmp(err, "ENOENT")) { - xenbus_write(XBT_NIL, fe_state, "7"); - free(err); - } + if (!strcmp(err, "ENOENT")) + free(xenbus_write(XBT_NIL, fe_state, "7")); + free(err); } } else if (state =3D=3D XenbusStateReconfigured) { printk("pcifront_watches: writing %s %d\n", fe_state, Xenb= usStateConnected); @@ -114,10 +113,9 @@ void pcifront_watches(void *opaque) if ((err =3D xenbus_switch_state(XBT_NIL, fe_state, Xenbus= StateConnected)) !=3D NULL) { printk("pcifront_watches: error changing state to %d: = %s\n", XenbusStateConnected, err); - if (!strcmp(err, "ENOENT")) { - xenbus_write(XBT_NIL, fe_state, "4"); - free(err); - } + if (!strcmp(err, "ENOENT")) + free(xenbus_write(XBT_NIL, fe_state, "4")); + free(err); } } else if (state =3D=3D XenbusStateClosing) break; @@ -135,7 +133,7 @@ void pcifront_watches(void *opaque) pcidev =3D NULL; } =20 - xenbus_unwatch_path_token(XBT_NIL, path, path); + free(xenbus_unwatch_path_token(XBT_NIL, path, path)); } =20 struct pcifront_dev *init_pcifront(char *_nodename) @@ -243,7 +241,7 @@ done: XenbusState state; snprintf(path, sizeof(path), "%s/state", dev->backend); =20 - xenbus_watch_path_token(XBT_NIL, path, path, &dev->events); + free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events)); =20 err =3D NULL; state =3D xenbus_read_integer(path); diff --git a/shutdown.c b/shutdown.c index c7c92cb..4c0b13c 100644 --- a/shutdown.c +++ b/shutdown.c @@ -71,7 +71,7 @@ static void shutdown_thread(void *p) char *shutdown, *err; unsigned int shutdown_reason; =20 - xenbus_watch_path_token(XBT_NIL, path, token, &events); + free(xenbus_watch_path_token(XBT_NIL, path, token, &events)); =20 for ( ;; ) { xenbus_wait_for_watch(&events); diff --git a/xenbus/xenbus.c b/xenbus/xenbus.c index b12cef7..9e61930 100644 --- a/xenbus/xenbus.c +++ b/xenbus/xenbus.c @@ -198,6 +198,8 @@ exit: } if (msg =3D=3D NULL && msg2 !=3D NULL) msg =3D msg2; + else + free(msg2); } while (retry); =20 return msg; --=20 2.16.4