From 31b2d898e509b75523888795aa955eb5ea7fd8f5 Mon Sep 17 00:00:00 2001 From: Matthew Ahrens Date: Mon, 3 Apr 2017 09:47:11 -0700 Subject: [PATCH] 8375 Kernel memory leak in nvpair code Reviewed by: Pavel Zakharov Reviewed by: George Wilson Reviewed by: Prashanth Sreenivasa Reviewed by: Robert Mustacchi In nvs_embedded(), when we return EINVAL due to reaching the recursion limit, we should free the nvpriv_t that was allocated earlier in the function. Closes #398 --- usr/src/common/nvpair/nvpair.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/usr/src/common/nvpair/nvpair.c b/usr/src/common/nvpair/nvpair.c index ca370b187472..5881ba54b726 100644 --- a/usr/src/common/nvpair/nvpair.c +++ b/usr/src/common/nvpair/nvpair.c @@ -21,7 +21,7 @@ /* * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved. - * Copyright (c) 2015, 2016 by Delphix. All rights reserved. + * Copyright (c) 2015, 2017 by Delphix. All rights reserved. */ #include @@ -2195,8 +2195,10 @@ nvs_embedded(nvstream_t *nvs, nvlist_t *embedded) nvlist_init(embedded, embedded->nvl_nvflag, priv); - if (nvs->nvs_recursion >= nvpair_max_recursion) + if (nvs->nvs_recursion >= nvpair_max_recursion) { + nvlist_free(embedded); return (EINVAL); + } nvs->nvs_recursion++; if ((err = nvs_operation(nvs, embedded, NULL)) != 0) nvlist_free(embedded);