Re: [PATCH] xen/gntdev: Fix gntdev_dmabuf ref leak in dmabuf_exp_wait_released()

[Juergen Gross]

On 16.09.26 19:09, Wentao Liang wrote:
> dmabuf_exp_wait_released() takes a reference on the exported
> gntdev_dmabuf with dmabuf_exp_wait_obj_get_dmabuf() and passes it to
> dmabuf_exp_wait_obj_new(), which drops that reference after adding the
> wait object to the wait list.  When the wait object allocation fails,
> dmabuf_exp_wait_obj_new() returns ERR_PTR(-ENOMEM) early and the
> reference is never dropped, leaking a reference to the exported
> gntdev_dmabuf.
>
> Drop the reference on the allocation failure path so the reference is
> consumed whether the wait object is created or not.
>
> Fixes: 932d6562179e ("xen/gntdev: Add initial support for dma-buf UAPI")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>

Reviewed-by: Juergen Gross <jgross@xxxxxxxx>


Juergen

Attachment: OpenPGP_0xB0DE9DD628BF132F.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature