On Sun, 30 Jul 2006, Stephen Hemminger wrote:

On Sun, 30 Jul 2006 21:38:02 +0200
Jesper Juhl [off-list ref] wrote:

quoted

There's an obvious memory leak in net/ipv4/tcp_probe.c::tcpprobe_read()
We are not freeing 'tbuf' on error.
Patch below fixes that.


Signed-off-by: Jesper Juhl <redacted>

Agreed, thanks for catching it.  The whole kfifo interface is kind of
annoying have to do an extra copy.

Might be cleaner to make a single return path for cleanup:

Signed-off-by: James Morris <jmorris@namei.org>

---

--- linux-2.6.18-rc2-mm1.o/net/ipv4/tcp_probe.c	2006-07-28 11:01:46.000000000 -0400
+++ linux-2.6.18-rc2-mm1.w/net/ipv4/tcp_probe.c	2006-07-30 17:45:53.000000000 -0400

@@ -130,11 +130,12 @@ static ssize_t tcpprobe_read(struct file
 	error = wait_event_interruptible(tcpw.wait,
 					 __kfifo_len(tcpw.fifo) != 0);
 	if (error)
-		return error;
+		goto out_free;
 
 	cnt = kfifo_get(tcpw.fifo, tbuf, len);
 	error = copy_to_user(buf, tbuf, cnt);
 
+out_free:
 	vfree(tbuf);
 
 	return error ? error : cnt;