mini-os: fix several memory leaks related to xenbus

There are several instances of calls to xenbus functions which don't
test for an error and in consequence are not freeing the returned
error strings, or which are just not freeing the string after e.g.
printing it.

Fix that by either adding the needed calls of free().

Coverity-ID: 1433632
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Wei Liu <wl@xen.org>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

diff --git a/blkfront.c b/blkfront.c
index f7472167a7715cb3b9ab78a13168a3a383b0d3f3..834a978f2134507b4738e98e1789228c0723c743 100644 (file)
--- a/blkfront.c
+++ b/blkfront.c
@@ -200,7 +200,7 @@ done:
 
         snprintf(path, sizeof(path), "%s/state", dev->backend);
 
-        xenbus_watch_path_token(XBT_NIL, path, path, &dev->events);
+        free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events));
 
         msg = NULL;
         state = xenbus_read_integer(path);
@@ -208,7 +208,7 @@ done:
             msg = xenbus_wait_for_state_change(path, &state, &dev->events);
         if (msg != NULL || state != XenbusStateConnected) {
             printk("backend not available, state=%d\n", state);
-            xenbus_unwatch_path_token(XBT_NIL, path, path);
+            free(xenbus_unwatch_path_token(XBT_NIL, path, path));
             goto error;
         }
 

diff --git a/console/xenbus.c b/console/xenbus.c
index 654b4699cce1204dee2e90cb90991d8b11eadd07..05fc31c02f64061339cab802e326023ef1188896 100644 (file)
--- a/console/xenbus.c
+++ b/console/xenbus.c
@@ -164,7 +164,7 @@ done:
         char path[strlen(dev->backend) + strlen("/state") + 1];
         snprintf(path, sizeof(path), "%s/state", dev->backend);
         
-       xenbus_watch_path_token(XBT_NIL, path, path, &dev->events);
+       free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events));
         msg = NULL;
         state = xenbus_read_integer(path);
         while (msg == NULL && state < XenbusStateConnected)

diff --git a/fbfront.c b/fbfront.c
index 9cc07b43093a99918d0265512a44783032f0b9ea..d3b38489fa9e64e1d62cc1864139f300393292ad 100644 (file)
--- a/fbfront.c
+++ b/fbfront.c
@@ -163,7 +163,7 @@ done:
 
         snprintf(path, sizeof(path), "%s/state", dev->backend);
 
-        xenbus_watch_path_token(XBT_NIL, path, path, &dev->events);
+        free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events));
 
         err = NULL;
         state = xenbus_read_integer(path);
@@ -530,7 +530,7 @@ done:
 
         snprintf(path, sizeof(path), "%s/state", dev->backend);
 
-        xenbus_watch_path_token(XBT_NIL, path, path, &dev->events);
+        free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events));
 
         err = NULL;
         state = xenbus_read_integer(path);

diff --git a/netfront.c b/netfront.c
index fe7bb6287ed82f368fff2382958a8592fe050a78..66f2bbc44184c32ffdf26038edd6ef7c63307126 100644 (file)
--- a/netfront.c
+++ b/netfront.c
@@ -513,7 +513,7 @@ done:
             err = xenbus_wait_for_state_change(path, &state, &dev->events);
         if (state != XenbusStateConnected) {
             printk("backend not avalable, state=%d\n", state);
-            xenbus_unwatch_path_token(XBT_NIL, path, path);
+            free(xenbus_unwatch_path_token(XBT_NIL, path, path));
             goto error;
         }
 

diff --git a/pcifront.c b/pcifront.c
index 0fc5b301bdff39de930d120d77b576c6b1b18ea5..56423562a572efd81c9550623fe58887810999f7 100644 (file)
--- a/pcifront.c
+++ b/pcifront.c
@@ -70,28 +70,28 @@ void pcifront_watches(void *opaque)
 
     while (1) {
         printk("pcifront_watches: waiting for backend path to appear %s\n", path);
-        xenbus_watch_path_token(XBT_NIL, path, path, &events);
+        free(xenbus_watch_path_token(XBT_NIL, path, path, &events));
         while ((err = xenbus_read(XBT_NIL, path, &be_path)) != NULL) {
             free(err);
             xenbus_wait_for_watch(&events);
         }
-        xenbus_unwatch_path_token(XBT_NIL, path, path);
+        free(xenbus_unwatch_path_token(XBT_NIL, path, path));
         printk("pcifront_watches: waiting for backend to get into the right state %s\n", be_path);
         be_state = (char *) malloc(strlen(be_path) +  7);
         snprintf(be_state, strlen(be_path) +  7, "%s/state", be_path);
-        xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events);
+        free(xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events));
         while ((err = xenbus_read(XBT_NIL, be_state, &msg)) != NULL || msg[0] > '4') {
             free(msg);
             free(err);
             xenbus_wait_for_watch(&events);
         }
-        xenbus_unwatch_path_token(XBT_NIL, be_state, be_state);
+        free(xenbus_unwatch_path_token(XBT_NIL, be_state, be_state));
         if (init_pcifront(NULL) == NULL) {
             free(be_state);
             free(be_path);
             continue;
         }
-        xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events);
+        free(xenbus_watch_path_token(XBT_NIL, be_state, be_state, &events));
         state = XenbusStateConnected;
         printk("pcifront_watches: waiting for backend events %s\n", be_state);
         while ((err = xenbus_wait_for_state_change(be_state, &state, &events)) == NULL &&
@@ -103,10 +103,9 @@ void pcifront_watches(void *opaque)
                 if ((err = xenbus_switch_state(XBT_NIL, fe_state, XenbusStateReconfiguring)) != NULL) {
                     printk("pcifront_watches: error changing state to %d: %s\n",
                             XenbusStateReconfiguring, err);
-                    if (!strcmp(err, "ENOENT")) {
-                        xenbus_write(XBT_NIL, fe_state, "7");
-                        free(err);
-                    }
+                    if (!strcmp(err, "ENOENT"))
+                        free(xenbus_write(XBT_NIL, fe_state, "7"));
+                    free(err);
                 }
             } else if (state == XenbusStateReconfigured) {
                 printk("pcifront_watches: writing %s %d\n", fe_state, XenbusStateConnected);
@@ -114,10 +113,9 @@ void pcifront_watches(void *opaque)
                 if ((err = xenbus_switch_state(XBT_NIL, fe_state, XenbusStateConnected)) != NULL) {
                     printk("pcifront_watches: error changing state to %d: %s\n",
                             XenbusStateConnected, err);
-                    if (!strcmp(err, "ENOENT")) {
-                        xenbus_write(XBT_NIL, fe_state, "4");
-                        free(err);
-                    }
+                    if (!strcmp(err, "ENOENT"))
+                        free(xenbus_write(XBT_NIL, fe_state, "4"));
+                    free(err);
                 }
             } else if (state == XenbusStateClosing)
                 break;
@@ -135,7 +133,7 @@ void pcifront_watches(void *opaque)
         pcidev = NULL;
     }
 
-    xenbus_unwatch_path_token(XBT_NIL, path, path);
+    free(xenbus_unwatch_path_token(XBT_NIL, path, path));
 }
 
 struct pcifront_dev *init_pcifront(char *_nodename)
@@ -243,7 +241,7 @@ done:
         XenbusState state;
         snprintf(path, sizeof(path), "%s/state", dev->backend);
 
-        xenbus_watch_path_token(XBT_NIL, path, path, &dev->events);
+        free(xenbus_watch_path_token(XBT_NIL, path, path, &dev->events));
 
         err = NULL;
         state = xenbus_read_integer(path);

diff --git a/shutdown.c b/shutdown.c
index c7c92cbac47fd6687eddf5847f30fd148f6a70d2..4c0b13cc32dbb42002afe4f3068879e9cac14a44 100644 (file)
--- a/shutdown.c
+++ b/shutdown.c
@@ -71,7 +71,7 @@ static void shutdown_thread(void *p)
     char *shutdown, *err;
     unsigned int shutdown_reason;
 
-    xenbus_watch_path_token(XBT_NIL, path, token, &events);
+    free(xenbus_watch_path_token(XBT_NIL, path, token, &events));
 
     for ( ;; ) {
         xenbus_wait_for_watch(&events);

diff --git a/xenbus/xenbus.c b/xenbus/xenbus.c
index b12cef78a3e509f72e0fb275f80dd5297c04ebf1..9e6193053ad5afc39fd7cdb4606c2d2967816e0e 100644 (file)
--- a/xenbus/xenbus.c
+++ b/xenbus/xenbus.c
@@ -198,6 +198,8 @@ exit:
         }
         if (msg == NULL && msg2 != NULL)
             msg = msg2;
+        else
+            free(msg2);
     } while (retry);
 
     return msg;