1*4882a593SmuzhiyunFrom 156c281a1625dc73fd350530630c6f2d5673d4f6 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Darren Kenny <darren.kenny@oracle.com> 3*4882a593SmuzhiyunDate: Tue, 8 Dec 2020 10:00:51 +0000 4*4882a593SmuzhiyunSubject: [PATCH] disk/ldm: Fix memory leak on uninserted lv references 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunThe problem here is that the memory allocated to the variable lv is not 7*4882a593Smuzhiyunyet inserted into the list that is being processed at the label fail2. 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunAs we can already see at line 342, which correctly frees lv before going 10*4882a593Smuzhiyunto fail2, we should also be doing that at these earlier jumps to fail2. 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunFixes: CID 73824 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunSigned-off-by: Darren Kenny <darren.kenny@oracle.com> 15*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 16*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 17*4882a593Smuzhiyun--- 18*4882a593Smuzhiyun grub-core/disk/ldm.c | 10 ++++++++-- 19*4882a593Smuzhiyun 1 file changed, 8 insertions(+), 2 deletions(-) 20*4882a593Smuzhiyun 21*4882a593Smuzhiyundiff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c 22*4882a593Smuzhiyunindex 54713f4..e82e989 100644 23*4882a593Smuzhiyun--- a/grub-core/disk/ldm.c 24*4882a593Smuzhiyun+++ b/grub-core/disk/ldm.c 25*4882a593Smuzhiyun@@ -321,7 +321,10 @@ make_vg (grub_disk_t disk, 26*4882a593Smuzhiyun lv->visible = 1; 27*4882a593Smuzhiyun lv->segments = grub_zalloc (sizeof (*lv->segments)); 28*4882a593Smuzhiyun if (!lv->segments) 29*4882a593Smuzhiyun- goto fail2; 30*4882a593Smuzhiyun+ { 31*4882a593Smuzhiyun+ grub_free (lv); 32*4882a593Smuzhiyun+ goto fail2; 33*4882a593Smuzhiyun+ } 34*4882a593Smuzhiyun lv->segments->start_extent = 0; 35*4882a593Smuzhiyun lv->segments->type = GRUB_DISKFILTER_MIRROR; 36*4882a593Smuzhiyun lv->segments->node_count = 0; 37*4882a593Smuzhiyun@@ -329,7 +332,10 @@ make_vg (grub_disk_t disk, 38*4882a593Smuzhiyun lv->segments->nodes = grub_calloc (lv->segments->node_alloc, 39*4882a593Smuzhiyun sizeof (*lv->segments->nodes)); 40*4882a593Smuzhiyun if (!lv->segments->nodes) 41*4882a593Smuzhiyun- goto fail2; 42*4882a593Smuzhiyun+ { 43*4882a593Smuzhiyun+ grub_free (lv); 44*4882a593Smuzhiyun+ goto fail2; 45*4882a593Smuzhiyun+ } 46*4882a593Smuzhiyun ptr = vblk[i].dynamic; 47*4882a593Smuzhiyun if (ptr + *ptr + 1 >= vblk[i].dynamic 48*4882a593Smuzhiyun + sizeof (vblk[i].dynamic)) 49*4882a593Smuzhiyun-- 50*4882a593Smuzhiyun2.14.2 51*4882a593Smuzhiyun 52