queue-2.6.22.y/cve-2007-3380-fix-memory-leak-in-dlm_add_member-when-dlm_node_weight-returns-less-than-zero.patch

   1 From 1a2bf2eefb63a267aea7f3f80d6ac59160e20810 Mon Sep 17 00:00:00 2001
   2 From: Jesper Juhl <jesper.juhl@gmail.com>
   3 Date: Thu, 19 Jul 2007 00:27:43 +0200
   4 Subject: [PATCH] [DLM] Fix memory leak in dlm_add_member() when dlm_node_weight() returns less than zero
   5
   6 There's a memory leak in fs/dlm/member.c::dlm_add_member().
   7
   8 If "dlm_node_weight(ls->ls_name, nodeid)" returns < 0, then
   9 we'll return without freeing the memory allocated to the (at
  10 that point yet unused) 'memb'.
  11 This patch frees the allocated memory in that case and thus
  12 avoids the leak.
  13
  14 Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
  15 Signed-off-by: David Teigland <teigland@redhat.com>
  16 Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
  17
  18 diff --git a/fs/dlm/member.c b/fs/dlm/member.c
  19 index 073599d..d099775 100644
  20 --- a/fs/dlm/member.c
  21 +++ b/fs/dlm/member.c
  22 @@ -56,8 +56,10 @@ static int dlm_add_member(struct dlm_ls *ls, int nodeid)
  23                 return -ENOMEM;
  24
  25         w = dlm_node_weight(ls->ls_name, nodeid);
  26 -       if (w < 0)
  27 +       if (w < 0) {
  28 +               kfree(memb);
  29                 return w;
  30 +       }
  31
  32         memb->nodeid = nodeid;
  33         memb->weight = w;