Mirrors/criu
1
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu.git synced 2026-07-18 00:58:31 +00:00
Code Issues Projects Releases Wiki Activity

sk-queue: Fix memory leaks in error paths

Browse source 
Fix several memory leaks in sk-queue error handling:

- collect_one_packet(): Free pkt->data when n_scm > 1 check fails.

- collect_one_packet(): Move list_add_tail() after read_img_buf() so
  that a packet with freed data is never left on the list.

- dump_scm_rights(): Free scme when dump_my_file() fails. The
  allocation from xmalloc() was leaked on this error path.

- send_one_pkt(): Free pkt->scm (allocated in prepare_scms()) after
  sendmsg(), alongside the existing xfree(pkt->data).

Signed-off-by: Ahmed Elaidy <elaidya225@gmail.com>
This commit is contained in:
Ahmed Elaidy 2026-02-25 21:09:33 +02:00 • committed by Andrei Vagin
parent 1524ffc996
commit 50e22d80a5
1 changed files with 14 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

22
criu/sk-queue.c
View file

@ -53,6 +53,13 @@ static int collect_one_packet(void *obj, ProtobufCMessage *msg, struct cr_img *i
*/
if (pkt->entry->n_scm > 1) {
pr_err("More than 1 SCM is not possible\n");
xfree(pkt->data);
return -1;
}
if (read_img_buf(img, pkt->data, pkt->entry->length) != 1) {
xfree(pkt->data);
pr_perror("Unable to read packet data");
return -1;
}
@ -62,12 +69,6 @@ static int collect_one_packet(void *obj, ProtobufCMessage *msg, struct cr_img *i
*/
list_add_tail(&pkt->list, &packets_list);
if (read_img_buf(img, pkt->data, pkt->entry->length) != 1) {
xfree(pkt->data);
pr_perror("Unable to read packet data");
return -1;
}
return 0;
}
@ -100,13 +101,17 @@ static int dump_scm_rights(struct cmsghdr *ch, SkPacketEntry *pe)
for (i = 0; i < nr_fds; i++) {
int ftyp;
if (dump_my_file(fds[i], &scme->rights[i], &ftyp))
if (dump_my_file(fds[i], &scme->rights[i], &ftyp)) {
xfree(scme);
return -1;
}
}
i = pe->n_scm++;
if (xrealloc_safe(&pe->scm, pe->n_scm * sizeof(ScmEntry *)))
if (xrealloc_safe(&pe->scm, pe->n_scm * sizeof(ScmEntry *))) {
xfree(scme);
return -1;
}
pe->scm[i] = scme;
return 0;
@ -318,6 +323,7 @@ static int send_one_pkt(int fd, struct sk_packet *pkt)
ret = sendmsg(fd, &mh, 0);
xfree(pkt->data);
xfree(pkt->scm);
if (ret < 0) {
pr_perror("Failed to send packet");
return -1;