|
 |
468bd4 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
468bd4 |
From: Darren Kenny <darren.kenny@oracle.com>
|
|
|
468bd4 |
Date: Tue, 8 Dec 2020 10:00:51 +0000
|
|
|
468bd4 |
Subject: [PATCH] disk/ldm: Fix memory leak on uninserted lv references
|
|
|
468bd4 |
|
|
|
468bd4 |
The problem here is that the memory allocated to the variable lv is not
|
|
|
468bd4 |
yet inserted into the list that is being processed at the label fail2.
|
|
|
468bd4 |
|
|
|
468bd4 |
As we can already see at line 342, which correctly frees lv before going
|
|
|
468bd4 |
to fail2, we should also be doing that at these earlier jumps to fail2.
|
|
|
468bd4 |
|
|
|
468bd4 |
Fixes: CID 73824
|
|
|
468bd4 |
|
|
|
468bd4 |
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
|
|
|
468bd4 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
468bd4 |
---
|
|
|
468bd4 |
grub-core/disk/ldm.c | 10 ++++++++--
|
|
|
468bd4 |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
468bd4 |
|
|
|
468bd4 |
diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c
|
|
|
09e3cc |
index 54713f45a..e82e9899f 100644
|
|
|
468bd4 |
--- a/grub-core/disk/ldm.c
|
|
|
468bd4 |
+++ b/grub-core/disk/ldm.c
|
|
|
468bd4 |
@@ -321,7 +321,10 @@ make_vg (grub_disk_t disk,
|
|
|
468bd4 |
lv->visible = 1;
|
|
|
468bd4 |
lv->segments = grub_zalloc (sizeof (*lv->segments));
|
|
|
468bd4 |
if (!lv->segments)
|
|
|
468bd4 |
- goto fail2;
|
|
|
468bd4 |
+ {
|
|
|
468bd4 |
+ grub_free (lv);
|
|
|
468bd4 |
+ goto fail2;
|
|
|
468bd4 |
+ }
|
|
|
468bd4 |
lv->segments->start_extent = 0;
|
|
|
468bd4 |
lv->segments->type = GRUB_DISKFILTER_MIRROR;
|
|
|
468bd4 |
lv->segments->node_count = 0;
|
|
|
468bd4 |
@@ -329,7 +332,10 @@ make_vg (grub_disk_t disk,
|
|
|
468bd4 |
lv->segments->nodes = grub_calloc (lv->segments->node_alloc,
|
|
|
468bd4 |
sizeof (*lv->segments->nodes));
|
|
|
468bd4 |
if (!lv->segments->nodes)
|
|
|
468bd4 |
- goto fail2;
|
|
|
468bd4 |
+ {
|
|
|
468bd4 |
+ grub_free (lv);
|
|
|
468bd4 |
+ goto fail2;
|
|
|
468bd4 |
+ }
|
|
|
468bd4 |
ptr = vblk[i].dynamic;
|
|
|
468bd4 |
if (ptr + *ptr + 1 >= vblk[i].dynamic
|
|
|
468bd4 |
+ sizeof (vblk[i].dynamic))
|