From: Dan Carpenter on
Commit 20413f27163 "x86, pat: Fix memory leak in free_memtype" added an
error message in free_memtype() if rbt_memtype_erase() returns NULL.
The problem is that if CONFIG_X86_PAT is enabled, we use a different
implimentation of rbt_memtype_erase() that always returns NULL.

I've modified rbt_memtype_erase() to return an ERR_PTR() on errors and
made free_memtype() check for that instead.

Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=16205

Signed-off-by: Dan Carpenter <error27(a)gmail.com>

diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index acc15b2..81b7735 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -359,10 +359,10 @@ int free_memtype(u64 start, u64 end)
entry = rbt_memtype_erase(start, end);
spin_unlock(&memtype_lock);

- if (!entry) {
+ if (IS_ERR(entry)) {
printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
current->comm, current->pid, start, end);
- return -EINVAL;
+ return PTR_ERR(entry);
}

kfree(entry);
diff --git a/arch/x86/mm/pat_rbtree.c b/arch/x86/mm/pat_rbtree.c
index f537087..90e5cbe 100644
--- a/arch/x86/mm/pat_rbtree.c
+++ b/arch/x86/mm/pat_rbtree.c
@@ -236,8 +236,10 @@ struct memtype *rbt_memtype_erase(u64 start, u64 end)
struct memtype *data;

data = memtype_rb_exact_match(&memtype_rbroot, start, end);
- if (!data)
+ if (!data) {
+ data = ERR_PTR(-EINVAL);
goto out;
+ }

rb_erase(&data->rb, &memtype_rbroot);
out:


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/