From cb16e5c76f4e719e6d0f9fd2cb6cfe6e6c17fed9 Mon Sep 17 00:00:00 2001 From: Klaus Jensen Date: Tue, 11 Apr 2023 20:34:11 +0200 Subject: [PATCH 1/2] hw/nvme: fix memory leak in fdp ruhid parsing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Coverity reports a memory leak of memory when parsing ruhids at namespace initialization. Since this is just working memory, not needed beyond the scope of the functions, fix this by adding a g_autofree annotation. Reported-by: Coverity (CID 1507979) Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation") Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Klaus Jensen --- hw/nvme/ns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c index cfac960dcf..547c0b1543 100644 --- a/hw/nvme/ns.c +++ b/hw/nvme/ns.c @@ -399,7 +399,8 @@ static bool nvme_ns_init_fdp(NvmeNamespace *ns, Error **errp) NvmeEnduranceGroup *endgrp = ns->endgrp; NvmeRuHandle *ruh; uint8_t lbafi = NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas); - unsigned int *ruhid, *ruhids; + g_autofree unsigned int *ruhids = NULL; + unsigned int *ruhid; char *r, *p, *token; uint16_t *ph; From 4b32319cdacd99be983e1a74128289ef52c5964e Mon Sep 17 00:00:00 2001 From: Klaus Jensen Date: Tue, 11 Apr 2023 20:54:44 +0200 Subject: [PATCH 2/2] hw/nvme: fix memory leak in nvme_dsm MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The iocb (and the allocated memory to hold LBA ranges) leaks if reading the LBA ranges fails. Fix this by adding a free and an unref of the iocb. Reported-by: Coverity (CID 1508281) Fixes: d7d1474fd85d ("hw/nvme: reimplement dsm to allow cancellation") Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 8b7be14209..ac24eeb5ed 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -2619,6 +2619,9 @@ static uint16_t nvme_dsm(NvmeCtrl *n, NvmeRequest *req) status = nvme_h2c(n, (uint8_t *)iocb->range, sizeof(NvmeDsmRange) * nr, req); if (status) { + g_free(iocb->range); + qemu_aio_unref(iocb); + return status; }