• J
    net/ipv4: Eliminate kstrdup memory leak · c34186ed
    Julia Lawall 提交于
    The string clone is only used as a temporary copy of the argument val
    within the while loop, and so it should be freed before leaving the
    function.  The call to strsep, however, modifies clone, so a pointer to the
    front of the string is kept in saved_clone, to make it possible to free it.
    
    The sematic match that finds this problem is as follows:
    (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @r exists@
    local idexpression x;
    expression E;
    identifier l;
    statement S;
    @@
    
    *x= \(kasprintf\|kstrdup\)(...);
    ...
    if (x == NULL) S
    ... when != kfree(x)
        when != E = x
    if (...) {
      <... when != kfree(x)
    * goto l;
      ...>
    * return ...;
    }
    // </smpl>
    Signed-off-by: NJulia Lawall <julia@diku.dk>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    c34186ed
tcp_cong.c 10.4 KB