On Mon, 10 Oct 2016 17:15:10 +0800
Li Qiang <liq...@gmail.com> wrote:
> Oops! I have made this patch to dress the memory leak in v9fs_xattrcreate
I guess you mean v9fs_xattrwalk().
There is no possible memory leak with v9fs_xattrwalk() because xattr_fidp
comes from alloc_fid(). The leak can only occur when xattr_fidp comes from
get_fid().
> but forget this and make another mistake.
>
> I mean we should call g_free for xattr.value first in xattr create.
>
> This avoid the memory leak.
>
> static void v9fs_xattrcreate(void *opaque)
> {
> ...
> g_free(xattr_fidp->fs.xattr.value);
> xattr_fidp->fs.xattr.value = g_malloc(size);
> err = offset;
>
> }
>
Indeed we have a potential leak with v9fs_xattrcreate().
> Should I resend this path series?
>
No, you just need to send a patch that fixes the leak in
v9fs_xattrcreate().
> 2016-10-10 17:06 GMT+08:00 Greg Kurz <gr...@kaod.org>:
>
> > On Sat, 8 Oct 2016 22:27:08 -0700
> > Li Qiang <liq...@gmail.com> wrote:
> >
> > > From: Li Qiang <liqiang...@360.cn>
> > >
> > > The 'fs.xattr.value' field in V9fsFidState object doesn't consider
> > > the situation that this field has been allocated previously. Every
> > > time, it will be allocated directly. This leads a host memory leak
> > > issue. This patch fix this.
> > >
> >
> > This cannot happen because v9fs_xattrwalk() always allocates this fid:
> >
> > xattr_fidp = alloc_fid(s, newfid);
> > if (xattr_fidp == NULL) {
> > err = -EINVAL;
> > goto out;
> > }
> >
> > > Signed-off-by: Li Qiang <liqiang...@360.cn>
> > > ---
> > > hw/9pfs/9p.c | 7 +++++--
> > > 1 file changed, 5 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> > > index 8751c19..3af23f9 100644
> > > --- a/hw/9pfs/9p.c
> > > +++ b/hw/9pfs/9p.c
> > > @@ -350,6 +350,7 @@ free_out:
> > > v9fs_string_free(&fidp->fs.xattr.name);
> > > free_value:
> > > g_free(fidp->fs.xattr.value);
> > > + fidp->fs.xattr.value = NULL;
> > > return retval;
> > > }
> > >
> > > @@ -3191,7 +3192,8 @@ static void v9fs_xattrwalk(void *opaque)
> > > xattr_fidp->fid_type = P9_FID_XATTR;
> > > xattr_fidp->fs.xattr.copied_len = -1;
> > > if (size) {
> > > - xattr_fidp->fs.xattr.value = g_malloc(size);
> > > + xattr_fidp->fs.xattr.value = g_realloc(
> > > + xattr_fidp->fs.xattr.value, size);
> > > err = v9fs_co_llistxattr(pdu, &xattr_fidp->path,
> > > xattr_fidp->fs.xattr.value,
> > > xattr_fidp->fs.xattr.len);
> > > @@ -3224,7 +3226,8 @@ static void v9fs_xattrwalk(void *opaque)
> > > xattr_fidp->fid_type = P9_FID_XATTR;
> > > xattr_fidp->fs.xattr.copied_len = -1;
> > > if (size) {
> > > - xattr_fidp->fs.xattr.value = g_malloc(size);
> > > + xattr_fidp->fs.xattr.value = g_realloc(
> > > + xattr_fidp->fs.xattr.value, size);
> > > err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path,
> > > &name, xattr_fidp->fs.xattr.value,
> > > xattr_fidp->fs.xattr.len);
> >
> >
